Let's say I have the the following configuration on a Cisco router.


Connected and configured into GigabitEthernet8.

VLAN 1, NAT configured.

Gateway is


Connected to interface FastEthernet0.

Currently not configured.

ISP gives one dynamic IP so "ip address dhcp" should be in place.

NAT must be configured.

What would you do to configure ISP 2 gateway to be

If ISP 1 fails and gateway is not reachable, it must not failover to ISP 2 gateway, also load-balancing must not be active.

The idea is to manually set the ISP 2 gateway on specific computers manually when needed, or through a DHCP server configured inside the subnet.


Current configuration, removed and censored unnecessary stuff.

interface FastEthernet0
 no ip address
 duplex auto
 speed auto
interface GigabitEthernet0
 no ip address
interface GigabitEthernet1
 no ip address
interface GigabitEthernet2
 no ip address
interface GigabitEthernet3
 no ip address
interface GigabitEthernet4
 no ip address
interface GigabitEthernet5
 no ip address
interface GigabitEthernet6
 no ip address
interface GigabitEthernet7
 no ip address
interface GigabitEthernet8
 ip address X.X.X.42 (First ISP 1 usable IP for NAT)
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 duplex full
 speed auto
 no keepalive
 no cdp enable
interface Vlan1
 ip address
 no ip proxy-arp
 ip nat inside
 ip inspect Firewall in
 ip virtual-reassembly in
ip nat inside source list NAT interface GigabitEthernet8 overload
ip nat inside source static X.X.X.43 extendable (A few NAT1:1)
ip nat inside source static X.X.X.44 extendable
ip nat inside source static X.X.X.45 extendable
ip nat inside source static X.X.X.46 extendable
ip route (ISP 1 gateway)
ip access-list standard ADMIN
ip access-list extended FILTERS
 permit icmp any any
 permit ip host host X.X.X.43 (Filters to allow NAT1:1 all traffic)
 permit ip host host X.X.X.44
 permit ip host host X.X.X.45
 permit ip host host X.X.X.46
ip access-list extended NAT
 permit ip any

Ideas for the solution,

We know that ISP 2 is at FastEthernet0 and has a dynamic IP, so also since it's only one IP we need NAT outside when more than one client uses the ISP 2 gateway, supposedly to be configured at

interface FastEthernet0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto

And after that I'm not sure what to do, add an outbound route for Internet access to the gateway for ISP 2? Set the ISP 2 gateway to be But how?


I have found this on a forum, please give it a read:


Be aware that the ISP 2 device is actually a generic Arris router that I have configured to be "bridged", I can set it back to routed and configure it according to that forum post if the setup can't done with the ISP 2 router working in bridge mode.

  • wouldn't it be easier to manually change the route on the router when needed? – JFL Mar 1 '17 at 18:44
  • Not really, some computers will be using the gateway for ISP 1 while others will be using the gateway for ISP 2. – GamerJota Mar 1 '17 at 18:47
  • "What would you do to configure ISP 2 gateway to be" I don't understand. If your connection to ISP 2 is via DHCP, its gateway that you must use is going to change. – Ron Maupin Mar 1 '17 at 18:54
  • 1
    Sounds from your comment that you need policy based routing. Maybe you should explain your topology and your needs and we could suggest you a better approach than this dual gateway thing (which will probably not solve your issue) – JFL Mar 1 '17 at 19:00
  • I agree with JFL. You can do PBR with some ip sla monitoring and maybe even a little EEM if need be. Make sure you have a spoon for the acronym soup. Seriously though, a diagram would be helpful, as I'm not getting the NAT-in-the-same-subnet-as-the-loopback but default route is off Gi0/8 thing. – theglossy1 Mar 2 '17 at 2:11

I think you misunderstood how a router process a packet, thus coming with a solution that is not at all appropriate for your needs.


Let say computer A has the following configuration:

  • mac address 00:53:BA:12:17:19
  • IP address
  • subnet mask of
  • default gateway

A send a packet to the internet host www.example.com which has IP address
The packet has the following characteristics:

  • source IP address :
  • destination IP address:

It compare (in binary) its subnet mask with the destination IP address and find that the destination is not on the local subnet, so it will send the packet to its default gateway,

It lookup in its ARP table and if needed perform an ARP request to find the mac address of the host which hold the IP address.
It finds 00:53:00:17:a7:b3

Then it builds a frame with the following characteristics:

  • source mac address: 00:53:BA:12:17:19
  • destination mac address: 00:53:00:17:a7:b3

inside this ethernet frame the IP packet is encapsulted, and it still has:

  • source IP address :
  • destination IP address:

As you can seed the destination IP address is NOT the gateway.

So the router receive this frame, strip the Ethernet header and lookup the packet to perform a routing decision.

The basic of routing is that the routing decision is made solely on the destination IP address, The router then look in its routing table, find a route for and send the packet through the associated interface (performing NAT if configured which is required here).

As you can see, the IP address of the gateway that was used has no role in the routing decision. And, more importantly, the router does not even know what was this IP address. It only know on which interface the frame arrived

Ok so, why not configuring 2 different gateways on two different interfaces. Well you can't, not on a Cisco router. You cannot have two overlapping networks on two different layer 3 interfaces. Otherwise the router could not decide on which interface it must send a packet for this network.

This is why your dual gateway cannot work. But more importantly, it's not required to achieve your goal.

What could work?

Now if you want the router to take a different routing decision based on the sender, it is possible. It's called policy based routing (PBR)

PBR allow you to configure different routing table on the router, and perform routing decision on different criteria.

The most common (and easy to configure) criteria are the source IP address and destination IP address.

Note that you can specify the outgoing interface rather than the next-hop IP, which is handy for a outgoing interface configured by DHCP.

So what you have to do (if I understood correctly what you want), is to:

  • set a group of computers with specific IP address pool (fixed IP, DHCP reservations)
  • set another group of computer with a second IP address pool
  • write a route map that will set the destination IP or outgoing interface for each pool
  • activate PBR on the incoming interface (the one that has the LAN gateway)

To manually change the outgoing interface for some computer in case one link fail, you just have to alter the route-map, which is a matter of minutes.

You can have 4 pools for example:

  • computers that will always use ISP 1, and never fail-over to ISP2
  • computers that will always use ISP 2, and never fail-over to ISP1
  • computer that will use ISP 1 if available, and manually fail-over to ISP2 if needed
  • computer that will use ISP 2 if available, and manually fail-over to ISP1 if needed
  • Thank you, I understand now. I will mark this as the solution since it works for using only the Cisco. But I will use the 2 routers solution I've found above since I don't know how to implement this PBR scenario, unless someone provides the full solution in here. Thanks! – GamerJota Mar 3 '17 at 16:17

Anything is possible; especially with Cisco routers. But to do what you are suggesting would most likely require contracting a specialist to set up and maintain a system like that.

Your requirement that it not perform a failover is a particularly unique requirement.

As part of your decision-making, consider the cost of having someone on-call at all times to sort out any errors that arise due to your configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.