2

I am trying to setup IP SLA for my WAN interface and want the NAT to be setup to when the link goes down the NAT will switch over.

Here is the config:

version 15.5
track 1 ip sla 10 reachability
interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 74.92.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 ip address 66.219.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
ip forward-protocol nd
ip nat inside source list 7 interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 66.219.x.x track 1
ip route 0.0.0.0 0.0.0.0 74.92.x.x 10
ip sla 10
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2
 frequency 10
ip sla schedule 10 life forever start-time now
access-list 7 permit any

I have tried multiple different configurations with the NAT, but cannot seem to get both in there and working once the link fails over.

5
  • An interface either participates in NAT (as inside or outside), or it doesn't. Have you considered using a loopback as the NAT interface? It never goes down, and then it doesn't matter if a WAN (outside) interface goes down, traffic still gets translated if there are other outside interfaces up.
    – Ron Maupin
    Sep 2 '15 at 16:18
  • How would that work? Since doesn't it determine the ip it nats to based on the interface? Sep 2 '15 at 20:51
  • My company has some NAT that runs off the loopbacks. One VLAN is the inside interface, and all the other interfaces are outside interfaces. Put the interface in the in the ip nat source list.
    – Ron Maupin
    Sep 2 '15 at 20:57
  • Ok, I will give that a try later tonight. Sep 2 '15 at 21:01
  • Your WAN interfaces are the outside interfaces, and your LAN interfaces are the inside interfaces. Set up a loopback and assign an address. You can use the loopback like: ip nat inside source list 7 interface Loopback0 overload. The loopback address must be an IP address reachable from outside the WAN interfaces.
    – Ron Maupin
    Sep 2 '15 at 21:04
3

You're correct, I overlooked that you're using an access-list for the nat statement. You'll want to change it to a route map. Example:

ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload
ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload
route-map wan1 permit 10
 match interface GigabitEthernet0/1
!        
route-map wan2 permit 10
 match interface GigabitEthernet0/2

I labbed your config to do a full test and there are a few extra bits you'll want to add.

You want to add a route to the ip you're pinging so it always goes out the correct interface:

ip route 8.8.8.8 255.255.255.255 66.219.1.1

Full example config (tested in VIRL), I made up the last 2 octets of your public IPs and gateways:

track 1 ip sla 1 reachability

interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
    !
interface GigabitEthernet0/1
 ip address 74.92.1.2 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 ip address 66.219.1.2 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/0
 ip address 10.1.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto

ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload
ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 66.219.1.1 track 1
ip route 0.0.0.0 0.0.0.0 74.92.1.1 10
ip route 8.8.8.8 255.255.255.255 66.219.1.1
!
ip sla 1
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2
 frequency 10
ip sla schedule 1 life forever start-time now
!
route-map wan1 permit 10
 match interface GigabitEthernet0/1
!        
route-map wan2 permit 10
 match interface GigabitEthernet0/2
3
  • Looks awesome. I will test it tonight when everyone leaves. I am a bit concerned with adding the route for pinging as we also use that IP for DNS. If that route drops we would lose DNS, correct? Sep 3 '15 at 9:56
  • Yes. I would suggest using either a different DNS or a different IP for SLA. Sep 3 '15 at 10:48
  • 1
    This is fantastic. Works perfectly!! Now I just need to tune it and or figure out how to clear the NAT once it does switch to the backup so open sessions either terminate or transfer to the secondary. But that might be asking too much and will probably settle for this. Sep 4 '15 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.