NAT Failover – Multiple WAN NAT with IP SLA

failovernat;wan

I am trying to setup IP SLA for my WAN interface and want the NAT to be setup to when the link goes down the NAT will switch over.

Here is the config:

version 15.5
track 1 ip sla 10 reachability
interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 74.92.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 ip address 66.219.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
ip forward-protocol nd
ip nat inside source list 7 interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 66.219.x.x track 1
ip route 0.0.0.0 0.0.0.0 74.92.x.x 10
ip sla 10
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2
 frequency 10
ip sla schedule 10 life forever start-time now
access-list 7 permit any

I have tried multiple different configurations with the NAT, but cannot seem to get both in there and working once the link fails over.

Best Answer

You're correct, I overlooked that you're using an access-list for the nat statement. You'll want to change it to a route map. Example:

ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload
ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload
route-map wan1 permit 10
 match interface GigabitEthernet0/1
!        
route-map wan2 permit 10
 match interface GigabitEthernet0/2

I labbed your config to do a full test and there are a few extra bits you'll want to add.

You want to add a route to the ip you're pinging so it always goes out the correct interface:

ip route 8.8.8.8 255.255.255.255 66.219.1.1

Full example config (tested in VIRL), I made up the last 2 octets of your public IPs and gateways:

track 1 ip sla 1 reachability

interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
    !
interface GigabitEthernet0/1
 ip address 74.92.1.2 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 ip address 66.219.1.2 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto

ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload
ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 66.219.1.1 track 1
ip route 0.0.0.0 0.0.0.0 74.92.1.1 10
ip route 8.8.8.8 255.255.255.255 66.219.1.1
!
ip sla 1
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2
 frequency 10
ip sla schedule 1 life forever start-time now
!
route-map wan1 permit 10
 match interface GigabitEthernet0/1
!        
route-map wan2 permit 10
 match interface GigabitEthernet0/2
Related Topic