1

I am trying to configure WAN redundancy across a pair of links, using ip sla to monitor link state and switch routes if one fails.

The design uses Loopback0 as a NAT interface, with the two WAN interfaces as transit networks. The ISP routers will have dynamic routing such that the IP assigned to Loopback0 will be accessible over either link.

The config currently looks like so:

track 100 ip sla 1 reachability
!
interface Loopback0
 ip address 1.2.3.224 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
!
interface GigabitEthernet0/0
 description COLT WAN
 ip address 1.2.3.9 255.255.255.254
 ip virtual-reassembly in
 duplex full
 speed 100
 no cdp enable
!
interface GigabitEthernet0/1
 description INSIDE LAN
 ip address 172.200.0.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly in
 duplex full
 speed 100
!         
interface GigabitEthernet0/1/0
 description VODAFONE INTERCONNECT
 switchport access vlan 100
 no ip address
 duplex full
 speed 100
 no cdp enable
!         
interface Vlan100
 description VODAFONE WAN
 ip address 1.2.3.135 255.255.255.254
 ip virtual-reassembly in
!
ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100
ip route 0.0.0.0 0.0.0.0 1.2.3.8 200
!
ip sla 1
 icmp-echo 1.2.3.134 source-ip 1.2.3.135
 frequency 5000
ip sla schedule 1 life forever start-time now

The router can ping 1.2.3.8 and 1.2.3.134, and both of these can ping 1.2.3.224. I have also verified that the redundant routing works if one of the links are down, although this doesn't appear to have any relation to this NAT issue.

From 172.200.0.0/24 I am able to ping 172.200.0.1, 1.2.3.224, 1.2.3.9 and 1.2.3.135 but not 1.2.3.8 or 1.2.3.134

|improve this question
0

I think you are doing this incorrectly. The WAN failover should be independent of your NAT. Try something like this:

track 100 ip sla 1 reachability
!
interface Loopback0
 ip address 1.2.3.224 255.255.255.254
 ip virtual-reassembly in
!
interface GigabitEthernet0/0
 description COLT WAN
 ip address 1.2.3.9 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
 duplex full
 speed 100
 no cdp enable
!
interface GigabitEthernet0/1
 description INSIDE LAN
 ip address 172.200.0.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly in
 duplex full
 speed 100
!         
interface GigabitEthernet0/1/0
 description VODAFONE INTERCONNECT
 switchport access vlan 100
 no ip address
 duplex full
 speed 100
 no cdp enable
!         
interface Vlan100
 description VODAFONE WAN
 ip address 1.2.3.135 255.255.255.254
 ip nat outside
 ip virtual-reassembly in
!
ip nat inside source list 10 interface Loopback0 overload
!
access-list 10 permit 172.200.0.0 0.0.255.255
!
ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100
ip route 0.0.0.0 0.0.0.0 1.2.3.8 200
!
ip sla 1
 icmp-echo 1.2.3.134 source-ip 1.2.3.135
 frequency 5000
ip sla schedule 1 life forever start-time now

You NAT from the inside interface GigabitEthernet0/1 to the outside interfaces GigabitEthernet0/0 and Vlan100. You use the Loopback0 interface as the address for the translation, not an outside interface, with the ip nat inside source list 10 interface Loopback0 overload command.

|improve this answer
  • Thanks for the comment, however this was where I started, and the traffic never hits the NAT. I didn't post the full NAT config in my original post but it was pretty much 100% what you mentioned above. I will update my question to better reflect the starting point. – btongeorge Feb 9 '16 at 20:56
  • I'm not sure where you went wrong, but what I posted in my answer will NAT traffic coming from the inside interface to the loopback address and out the outside interfaces, regardless of which one is active as the default route. This is the conventional, proven method to NAT. You may be looking in the wrong place. One caveat when using the loopback as the translation address is that the routers on the outside interfaces need to have a route to the loopback's address, or the traffic back will be dropped since the routers have no route to its destination. – Ron Maupin♦ Feb 9 '16 at 21:03
  • Just noticed in your config you have ip nat outside on the WAN interfaces and not Loop0 - this is maybe where I was going wrong. Will try again and revert. – btongeorge Feb 9 '16 at 21:06
  • That's what I explained in my answer. You NAT from the inside interface(s) to the outside interface(s). The loopback is neither, it is only used as the address for the NAT. – Ron Maupin♦ Feb 9 '16 at 21:09
  • Tested and works 100%. Apologies for not reading the answer you gave thoroughly enough first time. Thanks for your help :) – btongeorge Feb 9 '16 at 21:19
0

The problem is that traffic to internet is routed directly to the WAN ports, and thus are not NATted. To achieve what you want, you need a default route pointing at your "outside" interface, which in this case is your loopback.

However, just adding a static route pointing to your loopback wont work, because the NATted traffic needs to be routed also. So you have to create a routemap for policy based routing, steering only "unNATted" traffic to the loopback interface.

interface gi0/1 
 ip policy route-map loopback-nat

access-list 101 permit ip 172.200.0.1 0.0.255.255 any 

route-map loopback-nat permit 10
 match ip address 101
 set interface Loopback0

This is assuming that the rest of your NAT configuration is correct:

ip nat inside source list 101 interface Loopback0 overload

See this article for more explanation.

|improve this answer
  • thanks for that, makes sense. I've looked at the config in the example but can't work out which interface I should be putting the PBR on - Gi0/1 or Loop0? – btongeorge Feb 9 '16 at 17:52
  • route-map should be on Gi0/1, I'll update the answer. – RobinG Feb 9 '16 at 17:55
  • I implemented this but got a warning when adding the route-map, that the next hop was our IP (it's the Loop0 IP). At the moment I'm still not able to ping beyond the router, checking the config for typos now. – btongeorge Feb 9 '16 at 17:59
  • Is the ACL right? Looks like the subnet mask should be a wildcard no? – btongeorge Feb 9 '16 at 18:02
  • You're right, well spotted! I'm doing only Juniper in my day job at the moment, my IOS is a bit rusty... – RobinG Feb 9 '16 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.