求助高手，ASA5512双线接入同一服务器问题

findwz

公司有台ASA5512，想用双线接入一台WEB服务器，比喻电信用http://111.111.111.111:8081,联通用http://222.222.222.222:8081访问，给调防火墙的人来好几次没调好，我又是菜鸟。现在问题是电信能访问，联通就不行了。求高手给看看：
ASA Version 9.1(2)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 2KFQnbNIdI.2KYOU encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 111.111.111.111 255.255.255.248  -----电信IP
!
interface GigabitEthernet0/1
nameif outside1
security-level 0
ip address 222.222.222.222 255.255.255.248  -----联通IP
!
interface GigabitEthernet0/2
nameif inside
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
nameif guanli
security-level 0
ip address 192.168.2.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
dns server-group defaultDNS
dns server-group defaultdns
dns server-group enable
dns server-group global
object network internet
subnet 192.168.10.0 255.255.255.0
object network internet1
subnet 192.168.10.0 255.255.255.0
object network Inside11
host 192.168.10.2
object network Inside03
host 192.168.10.3
object network Inside02
host 192.168.10.2
object network Inside04
host 192.168.10.4
object network Inside12
host 192.168.10.2
object network Inside8081
host 192.168.10.2
access-list 102 extended permit tcp any host 192.168.10.2 eq 8266
access-list 102 extended permit tcp any host 192.168.10.2 eq 1188
access-list 104 extended permit tcp any host 192.168.10.2 eq 3389
access-list 104 extended permit tcp any host 192.168.10.2 eq www
access-list 104 extended permit tcp any host 192.168.10.3 eq 3389
access-list 104 extended permit tcp any host 192.168.10.4 eq 3389
pager lines 24
mtu outside 1500
mtu outside1 1500
mtu inside 1500
mtu guanli 1500
icmp unreachable rate-limit 1 burst-size 1
asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network internet
nat (inside,outside) dynamic interface dns
object network internet1
nat (inside,outside1) dynamic interface dns
object network Inside11
nat (inside,outside) static interface service tcp 3389 33892
object network Inside03
nat (inside,outside) static interface service tcp 3389 33893
object network Inside02
nat (inside,outside) static interface service tcp www 8081
object network Inside04
nat (inside,outside) static interface service tcp 3389 33894
object network Inside12
nat (inside,outside1) static interface service tcp 3389 33892
object network Inside8081
nat (inside,outside1) static interface service tcp www 8081
access-group 104 in interface outside
access-group 104 in interface outside1
route outside 0.0.0.0 0.0.0.0 111.111.111.110 1
route outside1 0.0.0.0 0.0.0.0 222.222.222.220 2
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server LOCAl protocol tacacs+
aaa-server Local protocol tacacs+
aaa-server Local (inside) host aaa-ssh
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.2.0 255.255.255.0 guanli
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet 192.168.10.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 192.168.10.0 255.255.255.0 inside
ssh timeout 30
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.10.20-192.168.10.200 inside
dhcpd dns 219.146.1.66 202.102.128.68 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username admin password izZCkX0.j7FlRkeS encrypted
username cisco password miNpFG.9QSZNEuyO encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 22
  subscribe-to-alert-group configuration periodic monthly 22
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:6487eeef6ad7a7a17fb12f33dddb2638
: end

jitong111

因为路由route outside 0.0.0.0 0.0.0.0 111.111.111.110 1 优先
所以另外的路由不生效

当你的111线路故障时可以删除这个路由 访问另外的就可以了