I am using a LTE Router with a Cellular interface.

I have a private LAN (/24 mask), so I'm using NAT to translate my private subnet in order to use the external public IP that my provider assigns to my cellular interface. This IP is dynamic, so here is what I am using :

ip access-list extended NAT
permit ip any 

ip nat inside source list NAT interface Cellular0 overload
ip route Cellular0 100

interface Cellular0
 ip nat outside

interface vlan10
 ip nat inside

This setup is working fine.

I also have a wired WAN interface, that I want to use when possible, therefore bypassing the Cellular interface. Seeing as I have a default route moving all packets to my cellular interface, here is what I have done to achieve using my Wired Gi0 interface when possible :

track 1 interface gigabitEthernet 0 line-protocol

ip route GigabitEthernet0 50 track 1
ip route Cellular0 100

But to be perfectly automatic, I would need to change my NAT command-line to this :

ip nat inside source list NAT interface **Gig0** overload

so that my private LAN traffic can be translated and use Gig0's public ip.

Is there a way to do this ? Cell0 and gig0 public IPs are not the same.


  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 10, 2017 at 3:03

2 Answers 2


Source address translation only takes place when a packet goes from an inside nat interface to an outside nat interface

You can just add the line

ip nat inside source list NAT interface GigabitEthernet0 overload

in addition to the line for the Cellular0 interface. Make sure the GigabitEthernet0 interface is also designated as an outside nat interface and the routing will take care of the rest.

When packets leave the GigabitEthernet0 interface the source address will be translated to the GigabitEthernet0 address, when they leave the Cellular0 interface they will be translated to the Cellular0 address.

  • Guy, thank you for your answer. Incidentally, I tried your suggestion but it does not work as it should. It seems that the first NAT has precedence over the other.
    – Jeremy G.
    Commented Sep 1, 2015 at 14:08
  • However, the use of route-maps to match the inside flow based on different criterias worked ; I will post my configuration above.
    – Jeremy G.
    Commented Sep 1, 2015 at 14:10

I found a way to correctly automate the failover between Gig0 and Cell0, including the NAT operation :

Match the private traffic based on the destination interface

route-map Cell0 permit 10
 match interface Cellular0
route-map gi0 permit 10
 match interface GigabitEthernet0

Create 2 NAT rules to translate the traffic towards the correct interface :

ip nat inside source route-map Cell0 interface Cellular0 overload
ip nat inside source route-map gi0 interface GigabitEthernet0 overload

With this piece of configuration, the failover is automatic - although when trying to ping a remote server, the ping fails and never comes back unless I clear the NAT translations, but the transition for the applications (Lync, Exchange) is seamless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.