Answer the question
In order to leave comments, you need to log in
Cisco router: how does NAT change when using IP SLA?
I can not figure it out, if you can, tell me please.
There is such a configuration:
Two external interfaces to two different providers
interface GigabitEthernet0/0
description MAIN_ISP
ip address 10.10.10.54 255.255.255.240 secondary
ip address 10.10.10.51 255.255.255.240
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1
description BACKUP_ISP
ip address 20.20.20.198 255.255.255.240 secondary
ip address 40.40.40.82 255.255.255.252
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/2
description link_between_2911_and_ASA
ip address 192.168.255.1 255.255.255.248
ip nat inside
ip virtual-reassembly in
ip policy route-map Load-Balance
duplex auto
speed auto
ip nat inside source static 192.168.6.54 10.10.10.54 route-map static-nat-isp-main
ip nat inside source static 192.168.6.54 20.20.20.198 route-map static-nat-isp-backup
route-map static-nat-isp-backup permit 10
match interface GigabitEthernet0/1
route-map static-nat-isp-main permit 10
match interface GigabitEthernet0/0
ip route 0.0.0.0 0.0.0.0 10.10.10.49 5 track 1
ip route 0.0.0.0 0.0.0.0 40.40.40.81 10 track 2
ip route 192.168.6.0 255.255.255.0 192.168.255.2
ip sla 1
icmp-echo 10.10.10.49 source-interface GigabitEthernet0/0
threshold 1000
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 40.40.40.81 source-interface GigabitEthernet0/1
threshold 1000
frequency 5
ip sla schedule 2 life forever start-time now
track 1 ip sla 1 reachability
delay down 5 up 5
!
track 2 ip sla 2 reachability
delay down 5 up 5
Answer the question
In order to leave comments, you need to log in
Numbers 5 and 10 for routes are called Administrative Distance, a more or less adequate Russian counterpart - "the degree of trust in the source of routing information."
ip route 0.0.0.0 0.0.0.0 10.10.10.49 5 track 1
ip route 0.0.0.0 0.0.0.0 40.40.40.81 10 track 2
Of the two identical valid routes, the one with the smaller AD will get into the routing table. In the first case, when both gateways are available, the router sends packets to the world that came from the host 192.168.6.54 with the Inside Global address 10.10.10.54, in the second case, Inside Global 20.20.20.198, i.e. depending on the routing table (more precisely, the FIB table), you have it enabled for both addresses:
ip nat inside source static 192.168.6.54 10.10.10.54 route-map static-nat-isp-main
ip nat inside source static 192.168.6.54 20.20.20.198 route-map static-nat-isp-backup
event manager applet ISP_1_UP
event track 1 state up
action 001 cli command "enable"
action 002 cli command "clear ip nat trans *"
action 003 syslog msg "ISP 1 is UP"
event manager applet ISP_1_DOWN
event track 1 state down
action 001 cli command "enable"
action 002 cli command "clear ip nat trans *"
action 003 syslog msg "ISP 1 is DOWN"
Thanks for the answer!
I understand one hundred NAT is enabled for both addresses.
The question is why when two or two gateways are available, then 10.10.10.54, and when the first gateway is not available, then - 20.20.20.198.
Where is the rule or where is the priority?
If I swap entries like this:
ip nat inside source static 192.168.6.54 10.10.10.54 route-map static-nat-isp-backup
ip nat inside source static 192.168.6.54 20.20.20.198 route-map static-nat-isp-main
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question