Cisco IOS multi WAN with NAT on Loopback0 with ip sla

Question

I am trying to configure WAN redundancy across a pair of links, using ip sla to monitor link state and switch routes if one fails.

The design uses Loopback0 as a NAT interface, with the two WAN interfaces as transit networks. The ISP routers will have dynamic routing such that the IP assigned to Loopback0 will be accessible over either link.

The config currently looks like so:

track 100 ip sla 1 reachability
!
interface Loopback0
 ip address 1.2.3.224 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
!
interface GigabitEthernet0/0
 description COLT WAN
 ip address 1.2.3.9 255.255.255.254
 ip virtual-reassembly in
 duplex full
 speed 100
 no cdp enable
!
interface GigabitEthernet0/1
 description INSIDE LAN
 ip address 172.200.0.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly in
 duplex full
 speed 100
!         
interface GigabitEthernet0/1/0
 description VODAFONE INTERCONNECT
 switchport access vlan 100
 no ip address
 duplex full
 speed 100
 no cdp enable
!         
interface Vlan100
 description VODAFONE WAN
 ip address 1.2.3.135 255.255.255.254
 ip virtual-reassembly in
!
ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100
ip route 0.0.0.0 0.0.0.0 1.2.3.8 200
!
ip sla 1
 icmp-echo 1.2.3.134 source-ip 1.2.3.135
 frequency 5000
ip sla schedule 1 life forever start-time now

The router can ping 1.2.3.8 and 1.2.3.134, and both of these can ping 1.2.3.224. I have also verified that the redundant routing works if one of the links are down, although this doesn't appear to have any relation to this NAT issue.

From 172.200.0.0/24 I am able to ping 172.200.0.1, 1.2.3.224, 1.2.3.9 and 1.2.3.135 but not 1.2.3.8 or 1.2.3.134

Answer 1

I think you are doing this incorrectly. The WAN failover should be independent of your NAT. Try something like this:

track 100 ip sla 1 reachability
!
interface Loopback0
 ip address 1.2.3.224 255.255.255.254
 ip virtual-reassembly in
!
interface GigabitEthernet0/0
 description COLT WAN
 ip address 1.2.3.9 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
 duplex full
 speed 100
 no cdp enable
!
interface GigabitEthernet0/1
 description INSIDE LAN
 ip address 172.200.0.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly in
 duplex full
 speed 100
!         
interface GigabitEthernet0/1/0
 description VODAFONE INTERCONNECT
 switchport access vlan 100
 no ip address
 duplex full
 speed 100
 no cdp enable
!         
interface Vlan100
 description VODAFONE WAN
 ip address 1.2.3.135 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
!
ip nat inside source list 10 interface Loopback0 overload
!
access-list 10 permit 172.200.0.0 0.0.255.255
!
ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100
ip route 0.0.0.0 0.0.0.0 1.2.3.8 200
!
ip sla 1
 icmp-echo 1.2.3.134 source-ip 1.2.3.135
 frequency 5000
ip sla schedule 1 life forever start-time now

You NAT from the inside interface GigabitEthernet0/1 to the outside interfaces GigabitEthernet0/0 and Vlan100. You use the Loopback0 interface as the address for the translation, not an outside interface, with the ip nat inside source list 10 interface Loopback0 overload command.

Answer 2

The problem is that traffic to internet is routed directly to the WAN ports, and thus are not NATted. To achieve what you want, you need a default route pointing at your "outside" interface, which in this case is your loopback.

However, just adding a static route pointing to your loopback wont work, because the NATted traffic needs to be routed also. So you have to create a routemap for policy based routing, steering only "unNATted" traffic to the loopback interface.

interface gi0/1 
 ip policy route-map loopback-nat

access-list 101 permit ip 172.200.0.1 0.0.255.255 any 

route-map loopback-nat permit 10
 match ip address 101
 set interface Loopback0

This is assuming that the rest of your NAT configuration is correct:

ip nat inside source list 101 interface Loopback0 overload

See this article for more explanation.