Question about configurations on Cisco router 3925

Question

Here is my router's configurations (with fake public IP addresses):

interface GigabitEthernet0/0
 ip address 113.160.61.14 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 101.96.10.141 255.255.255.192
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
! 
interface GigabitEthernet0/2
 ip address 172.16.2.28 255.255.255.248
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
ip nat inside source list ftth interface GigabitEthernet0/0 overload
!
ip route 0.0.0.0 0.0.0.0 113.160.61.13 100
ip route 0.0.0.0 0.0.0.0 101.96.10.129 200
!
ip access-list extended ftth
 permit ip 192.168.7.0 0.0.0.255 any
 permit ip 192.168.1.0 0.0.0.255 any
 permit ip 192.168.8.0 0.0.0.255 any
 permit ip 192.168.9.0 0.0.0.255 any

This is a result from show ip int b:

Interface                  IP-Address       OK?     Method Status            Protocol
GigabitEthernet0/0         113.160.61.14    YES     NVRAM  up                    up
GigabitEthernet0/1         101.96.10.141    YES     manual up                    up
NVI0                       113.160.61.14    YES     unset  up                    up

---

So as you can see we have two WAN interfaces to two different ISPs, we change some configurations and saw some behaviors as below:

1. If I keep this setting, both WAN links are okay as we can ping 8.8.8.8 from them (ping source), the default route go to 113.160.61.13 as expected.
2. If I change ip nat inside source list ftth interface GigabitEthernet0/0 overload to ip nat inside source list ftth interface GigabitEthernet0/1 overload, both WAN links are still okay as we can ping 8.8.8.8 from them (ping source), the default route still go through 113.160.61.13
3. But if I did step 2, also change ip route 0.0.0.0 0.0.0.0 101.96.10.129 200 to ip route 0.0.0.0 0.0.0.0 101.96.10.129 20, there is no more Internet, can ping 8.8.8.8 from source 101.96.10.141 but cannot from the other link
4. The Internet come back when I shutdown interface g0/0, default route now points to 101.96.10.129

So can anyone explain these behaviors on step 2, 3 and 4? Is it NVI interface related? We would like to have both links UP and be able to ping 8.8.8.8.

Answer 1

First of all, your NAT rules are triggered only for the traffic which first arrives at nat inside interface - that is your Gi0/2. Since you're pinging from the wan interfaces (Gi0/0 and Gi0/1) as your source, this doesn't trigger any translation, and your source ip remains unchanged in icmp packets. What actually happens is probably related to lack of routing information at one of your ISPs. My assumption is, that your ISP1 known how to reach both 113.160.61.14 and 101.96.10.141, while ISP2 doesn't know how to reach 113.160.61.14, thus, when your default route is pointing towards ISP2, your pings are lost, when sourced from 113.160.61.14.

Now, for your internal hosts behind Gi0/2 to reach internet, you need to configure two nat rules, as already mentioned by Ron Maupin.

Answer 2

This is the cisco document you are looking for: http://docwiki.cisco.com/wiki/NAT_failover_with_DUAL_ISP_on_a_router_Configuration_Example

Basically the existing nat is being re-used out the second ISP port and being dropped by the second ISP as a spoofed IP address.

The important part of the config is the dual route-maps with the match condition on the outgoing interface:

route-map isp1 permit 10
match ip address 100    <----note acl 100 in the example needs to be your internal networks
match interface FastEthernet0/0

route-map isp2 permit 10
match ip address 100
match interface FastEthernet1/0