摘要：双WAN线路接入，不同服务通过映射走不同WAN口进入内部网络 链路冗余，主线路中断后流量切换至第二条线路(出站) 通过show run查看接口和VLAN划分情况 interface Vlan1 nameif inside……

双WAN线路接入，不同服务通过映射走不同WAN口进入内部网络

ASA5505 双 ISP 接入：双 WAN 备份配置
图片素材来自免费商用图库（pixabay，摄影师 Bru-nO），非本站项目实拍。

链路冗余，主线路中断后流量切换至第二条线路(出站)

通过show run查看接口和VLAN划分情况

interface Vlan1

nameif inside

security-level 100

ip address 192.168.15.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.3.100 255.255.252.0

!

interface Vlan3

nameif outside1

security-level 0

ip address 172.16.19.2 255.255.255.0

定义两个网络对象

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network obj_172

subnet 0.0.0.0 0.0.0.0

用来进行OUTSIDE口IP映射的内部主机192.168.15.11 端口3389

OUTSIDE(0/0)口IP 192.168.3.100 使用的映射IP 192.168.3.101

OUTSIDE1(0/1)口IP 172.16.19.2 使用的映射IP 172.16.19.13

object network 192.168.15.11

host 192.168.15.11

object network 192.168.15.11-2

host 192.168.15.11

object-group service 192.168.3.101

service-object tcp-udp destination eq 3389

object-group service 172.16.19.13

service-object tcp-udp destination eq 3389

访问控制列表规则

access-list outside_access extended permit object-group 192.168.3.101 any object 192.168.15.11

access-list outside_access extended permit object-group 172.16.19.13 any object 192.168.15.11-2

access-list outside_access_in extended permit ip any any

NAT规则

object network obj_any

nat (inside,outside) dynamic interface

object network 192.168.15.11

nat (inside,outside) static 192.168.3.101 dns

object network obj_172

nat (inside,outside1) dynamic interface

object network 192.168.15.11-2

nat (inside,outside1) static 172.16.19.13 dns

在接口上应用规则

access-group outside_access_in in interface outside control-plane

access-group outside_access in interface outside

access-group outside_access_in in interface outside1 control-plane

access-group outside_access in interface outside1

两条外部接口的静态路由，默认路由接口为OUTSIDE(0/0)

route outside 0.0.0.0 0.0.0.0 192.168.1.254 1

route outside1 0.0.0.0 0.0.0.0 172.16.19.1 2

三、配置要点

  • SLA → 探测主线路可达性。
  • track → 联动路由切换。
  • 优先级 → 主备明确，断即切。

ASA 双 ISP 备份靠 SLA+track：持续探测主线路，一旦失联立即把流量切到备 ISP。重点是探测阈值别太敏感，避免抖动误切。

本文整理自公开技术文章，正文未做实质性改写，仅供技术参考。正文主体与原文基本一致，版权归原作者所有；本站仅作技术学习与方案参考，如涉侵权请联系本站删除。