Showing results for 
Search instead for 
Did you mean: 

ASR NAT Redundancy

Jonathan Ridgway


I have created a redundancy group between two ASR 1001-X routers and sometimes experience a problem where return traffic does not get "un-translated" back to the initiating device of the TCP session. The NAT translation table always looks the same on both routers as expected.

ASR-HUB-01#show ip nat translations redundancy 1

Pro Inside global      Inside local       Outside local      Outside global

tcp   ---                ---

tcp   ---                ---




HTTP, Ping and VNC all work. I can shutdown the LAN and WAN from ASR-1 and all traffic goes to ASR-2 as expected.

However, if I shut down the WAN on one router and the LAN on the other router, in order to make the traffic asymmetric, the return traffic does not pass correctly from the web server to the web client. Also the static NAT for VNC does not work either. However, ping continues to work fine. When this is the case and I keep refreshing the web page, I see a new translation each time, and I think this is just because the browser does not get a response so it keeps starting a new session. Same thing happens for the VNC port forwarding rule.

"redundancy application reload group 1 self" on both routers does not solve the problem but a full reload of IOS-XE does.

"show redundancy application protocol group 1" shows at least one ASR-01 active (the one with the LAN interface up - or ASR-01 if both are up as this has priority 105)

Topology and full configurations attached. 

Any suggestions welcome. 

Could be something to do with "ip nat switchover replication http" ?

0 Replies 0
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers