Let's say I have the the following configuration on a Cisco router.


Connected and configured into GigabitEthernet8.

VLAN 1, NAT configured.

Gateway is


Connected to interface FastEthernet0.

Currently not configured.

ISP gives one dynamic IP so "ip address dhcp" should be in place.

NAT must be configured.

What would you do to configure ISP 2 gateway to be

If ISP 1 fails and gateway is not reachable, it must not failover to ISP 2 gateway, also load-balancing must not be active.

The idea is to manually set the ISP 2 gateway on specific computers manually when needed, or through a DHCP server configured inside the subnet.


Current configuration, removed and censored unnecessary stuff.

interface FastEthernet0
 no ip address
 duplex auto
 speed auto
interface GigabitEthernet0
 no ip address
interface GigabitEthernet1
 no ip address
interface GigabitEthernet2
 no ip address
interface GigabitEthernet3
 no ip address
interface GigabitEthernet4
 no ip address
interface GigabitEthernet5
 no ip address
interface GigabitEthernet6
 no ip address
interface GigabitEthernet7
 no ip address
interface GigabitEthernet8
 ip address X.X.X.42 (First ISP 1 usable IP for NAT)
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 duplex full
 speed auto
 no keepalive
 no cdp enable
interface Vlan1
 ip address
 no ip proxy-arp
 ip nat inside
 ip inspect Firewall in
 ip virtual-reassembly in
ip nat inside source list NAT interface GigabitEthernet8 overload
ip nat inside source static X.X.X.43 extendable (A few NAT1:1)
ip nat inside source static X.X.X.44 extendable
ip nat inside source static X.X.X.45 extendable
ip nat inside source static X.X.X.46 extendable
ip route (ISP 1 gateway)
ip access-list standard ADMIN
ip access-list extended FILTERS
 permit icmp any any
 permit ip host host X.X.X.43 (Filters to allow NAT1:1 all traffic)
 permit ip host host X.X.X.44
 permit ip host host X.X.X.45
 permit ip host host X.X.X.46
ip access-list extended NAT
 permit ip any

Ideas for the solution,

We know that ISP 2 is at FastEthernet0 and has a dynamic IP, so also since it's only one IP we need NAT outside when more than one client uses the ISP 2 gateway, supposedly to be configured at

interface FastEthernet0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto

And after that I'm not sure what to do, add an outbound route for Internet access to the gateway for ISP 2? Set the ISP 2 gateway to be But how?


I have found this on a forum, please give it a read:


Be aware that the ISP 2 device is actually a generic Arris router that I have configured to be "bridged", I can set it back to routed and configure it according to that forum post if the setup can't done with the ISP 2 router working in bridge mode.

  • wouldn't it be easier to manually change the route on the router when needed?
    – JFL
    Mar 1, 2017 at 18:44
  • Not really, some computers will be using the gateway for ISP 1 while others will be using the gateway for ISP 2.
    – user34559
    Mar 1, 2017 at 18:47
  • "What would you do to configure ISP 2 gateway to be" I don't understand. If your connection to ISP 2 is via DHCP, its gateway that you must use is going to change.
    – Ron Maupin
    Mar 1, 2017 at 18:54
  • 1
    Sounds from your comment that you need policy based routing. Maybe you should explain your topology and your needs and we could suggest you a better approach than this dual gateway thing (which will probably not solve your issue)
    – JFL
    Mar 1, 2017 at 19:00
  • I agree with JFL. You can do PBR with some ip sla monitoring and maybe even a little EEM if need be. Make sure you have a spoon for the acronym soup. Seriously though, a diagram would be helpful, as I'm not getting the NAT-in-the-same-subnet-as-the-loopback but default route is off Gi0/8 thing.
    – theglossy1
    Mar 2, 2017 at 2:11

3 Answers 3


I think you misunderstood how a router process a packet, thus coming with a solution that is not at all appropriate for your needs.


Let say computer A has the following configuration:

  • mac address 00:53:BA:12:17:19
  • IP address
  • subnet mask of
  • default gateway

A send a packet to the internet host www.example.com which has IP address
The packet has the following characteristics:

  • source IP address :
  • destination IP address:

It compare (in binary) its subnet mask with the destination IP address and find that the destination is not on the local subnet, so it will send the packet to its default gateway,

It lookup in its ARP table and if needed perform an ARP request to find the mac address of the host which hold the IP address.
It finds 00:53:00:17:a7:b3

Then it builds a frame with the following characteristics:

  • source mac address: 00:53:BA:12:17:19
  • destination mac address: 00:53:00:17:a7:b3

inside this ethernet frame the IP packet is encapsulted, and it still has:

  • source IP address :
  • destination IP address:

As you can seed the destination IP address is NOT the gateway.

So the router receive this frame, strip the Ethernet header and lookup the packet to perform a routing decision.

The basic of routing is that the routing decision is made solely on the destination IP address, The router then look in its routing table, find a route for and send the packet through the associated interface (performing NAT if configured which is required here).

As you can see, the IP address of the gateway that was used has no role in the routing decision. And, more importantly, the router does not even know what was this IP address. It only know on which interface the frame arrived

Ok so, why not configuring 2 different gateways on two different interfaces. Well you can't, not on a Cisco router. You cannot have two overlapping networks on two different layer 3 interfaces. Otherwise the router could not decide on which interface it must send a packet for this network.

This is why your dual gateway cannot work. But more importantly, it's not required to achieve your goal.

What could work?

Now if you want the router to take a different routing decision based on the sender, it is possible. It's called policy based routing (PBR)

PBR allow you to configure different routing table on the router, and perform routing decision on different criteria.

The most common (and easy to configure) criteria are the source IP address and destination IP address.

Note that you can specify the outgoing interface rather than the next-hop IP, which is handy for a outgoing interface configured by DHCP.

So what you have to do (if I understood correctly what you want), is to:

  • set a group of computers with specific IP address pool (fixed IP, DHCP reservations)
  • set another group of computer with a second IP address pool
  • write a route map that will set the destination IP or outgoing interface for each pool
  • activate PBR on the incoming interface (the one that has the LAN gateway)

To manually change the outgoing interface for some computer in case one link fail, you just have to alter the route-map, which is a matter of minutes.

You can have 4 pools for example:

  • computers that will always use ISP 1, and never fail-over to ISP2
  • computers that will always use ISP 2, and never fail-over to ISP1
  • computer that will use ISP 1 if available, and manually fail-over to ISP2 if needed
  • computer that will use ISP 2 if available, and manually fail-over to ISP1 if needed
  • Thank you, I understand now. I will mark this as the solution since it works for using only the Cisco. But I will use the 2 routers solution I've found above since I don't know how to implement this PBR scenario, unless someone provides the full solution in here. Thanks!
    – user34559
    Mar 3, 2017 at 16:17

If you want to follow this rule you've posted: The idea is to manually set the ISP 2 gateway on specific computers manually when needed, or through a DHCP server configured inside the subnet.

... then do what I do.

I have two TPLink routers, one landline and one 4G on the same subnet. (I use both so that I don't have to reconfigure the 4G one every time, it only works in either WAN or 4G mode, plus the 1st one shows LED activity for WAN when the landline resumes working. During hot summer days, cheap power plugs mess up ISP's switches along the chained path, some turn off or flicker and the whole net goes down.)

On both of them DHCP sets the same reserved IPs for known MACs but for unknown MACs these deliver different ranges of IPs. Not that important as long as router 2 is in the same network, but a backup DHCP doesn't hurt.

Both deliver their own gateway, which I've set as and respectively.

When the internet on the main router goes down, I just go in the TCP/IPv4 setting of my PC and set up the gateways manually with different metrics.

I give, the gateway of the 4G router a lower metric (like 1) and manually redefine the default gateway a higher metric (like 100). Both must be redefined, it won't work if one still has metric auto. Now packets will defer to router 2's routings. Metrics can be viewed as numerous things like shorter length between endpoints, lower latency etc. So the smaller the value, the more preferred it is.

Make some quick batch scripts that you can run on all PC's that absolutely need internet and you're good to go, the simplest and fastest way. In batch I just use route command to remove old route and add new ones. route delete route add mask metric 1 route add mask metric 100

Also when reverting, while powering off the 4G router route delete route add mask metric 1

Otherwise with both powered up constantly, just set one gateway, of the one that's meant to be up 99% of the time, but if it's a wireless one, it will not work properly as a backup.

I would look up if policy based routing can be implemented safely and update this response, but in my case it's not the right move. The way my landline goes down when it's really hot outside, is that it flickers, meaning switches along my ISP's network regain power but lose it again, internet comes back up for 10-20 sec and then goes down again. While in the adapters and router this registers as being online, it takes a while for the router to figure out it's not, over and over again. So the best way for me is to use the most stable path to internet, and that is of the 4G router until things cool down, which means manually setting it up and avoiding policy based routing. Maybe in your case it's different.

  • What you describe is no way to run a business network, and the contract your business has with its ISP should have some guarantees so that penalties apply when it gets hot and the connection quits working. Also, the consumer-grade devices you are using are off-topic here.
    – Ron Maupin
    Aug 24, 2019 at 14:34
  • The contract does have a no-liability 72 hours time-to-fix clause from the moment the issue is reported. Today is Saturday afternoon, this means I can only contact them on Monday and then within 72h they can if it legally.
    – JasonXA
    Aug 24, 2019 at 15:22
  • And yes, it's a consumer grade hardware solution tailored to the one condition the op worte.
    – JasonXA
    Aug 24, 2019 at 15:22
  • This site is for professionally managed networks in a business environment. Please do not answer with off-topic suggestions. What you describe would never be used in a professionally managed business network.
    – Ron Maupin
    Aug 24, 2019 at 15:26
  • I know... but as I've said, what the used asked, was a non-professional setup: manually changing gateways at certain endpoints. Maybe the question would have been better put on superuser, then.
    – JasonXA
    Aug 24, 2019 at 15:30

Anything is possible; especially with Cisco routers. But to do what you are suggesting would most likely require contracting a specialist to set up and maintain a system like that.

Your requirement that it not perform a failover is a particularly unique requirement.

As part of your decision-making, consider the cost of having someone on-call at all times to sort out any errors that arise due to your configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.