Alternative to PBR on ASA5510

Question

We have an ASA5510 with a backup ISP connection protecting our corporate network.  I also have a mail server and I would like to route SMTP traffic over the backup network.  I realize that the ASA5510 does not support PBR, but I also know that I can use static NAT rules as a workaround to direct specific types of traffic over a particular interface (e.g. "static (outside,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0" and "static (backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0").
My question is, is it possible to use something similar to force a particular host to use a specific interface? I have tried to make this work on my own without success.  Is it even possible?

Answer 1

Hi Jonathan,
If i understand correctly, you require that a particular host, use the backup ISP instead of the main one, while going out to the internet.
I don't think this would be possible, since the internal flow goes like this:
X: address in local LAN
Y: some address on the internet
Outside: Interface connected to main internet
Backup: Interface connected to backup internet
static (inside,Backup) X  OR nat (inside) and global(Backup) has been configured on ASA
Packet with source X and destination Y reaches inside interface of ASA
ASA does a route lookup for Y and sees that the main ISP default route has the least metric
Thus it decides that egress interface should be Outside.
So now, when looking for a NAT entry, it looks for a static(inside,Outside) or a matching global(Outside) and not for the static (inside,backup) or global (Backup) which we configured for it.
Thus its not possible to do a source based routing using static NAT. Destination based yes (as described in the smtp/www example in your post). Unfortunately not source based.
Hope this helps.
-Shrikant
P.S.: Please mark the question as resolved if it has been answered. Do rate helpful posts. Thanks