HSRp + NAT + Route-map

[salemmahara]

Hello everyone,

we use to do NAT on our router but we are planned to buy a couple of routers to provide redundancy.

But I heard NAT doesn't work with HSRP!

Our configuration:

ip nat inside source route-map X interface X/X overload

Now, we are planned to apply following command:

ip nat pool TEST x.x.x.1 x.x.x.1 mask 255.255.255.0

ip nat inside source route-map X pool TEST overload

* x.x.x.1 is virtual ip of our routers connected to outside

* Route-map X shows on which traffic should NAT effect

If it is not going to work, what is the solution? 

Our new routers will be ISR 4000

[Georg Pauwen]

Hello,

according to Cisco:

Licenses are managed as smart licenses from Cisco IOS XE Fuji 16.9.1 and later. Right-to-Use licenses are deprecated from Cisco IOS XE Fuji 16.9.1.

That means you can upgrade to 16.9.1 as RTU, but no higher without a smart license (which indeed requires Internet access.

Regarding the ACL problem, can you post the config you have finally come up with ? 

[salemmahara]

So what would happen after an accidental upgrade to 16.9.X ? Does it mean device will stop working? After that, What is required to configure smart start? and what will happen to currently active RTU license ? We don't have any active RTU license on or Switches and Routers.

BTW, Configuration is exactly like what you said, except Event Manager to clear NAT Translations. 

we also have an ACL on our outside hand to control incoming traffics (ip access-group 150 in).

This ACL contains different access. But 2 of this lines( sequences of 60 and 150) stop working after a while (once has happen). Interestingly, ACL Match hint is increasing which means traffic is coming but it our clients don't receive response! These 2 lines are checking traffics coming to response routed traffic. All other lines of ACL are working fine (Containing Natted and routed traffic). 

Everything become okay after removing and rewriting these 2 lines .

[Giuseppe Larosa]

Hello @salemmahara ,

first of all @Georg Pauwen and @paul driver have provided the best solutions in this thread, specially EEM scripts from Georg are good. A +5 for Georg is well deserved

You can mark as solutions one or more answers of the same or different frequent contributor / Expert. You can even mark your own answer as a solution in current Cisco Community.

>> We have copied ACLs from our previous router to the new ones. One ACL is checking input traffic through an interface. All traffics are passing fine, but traffics from a specific router (containing different services) stop passing through the router after a while! We have to remove and rewrite those lines of ACL related to these traffic. When we check the ACL, the Match hint is increasing, even when clients can't see the services!!! Other services and lines of ACL are working fine at the same time. I removed and rewrite the whole of ACL from the scratch. Have you even been in such situation?

I usually take a show tech and other key show commands before and after the upgrade and if possible using a terminal server I would record the upgrade process.

So yes some strange things can happen after an IOS , IOS XE or IOS XR upgrade.

>> Another question. I've heard Cisco is forcing costumers to use Smart license since IOS XE 16.9.x . Is it true? Does it mean, if we don't have internet access, we can not upgrade to 16.9.x ? What would happen if we do it? 

As it happens for CUCM clusters I think it is possible to setup a License Manager that is a virtual machine or a bare metal server that will take care of accessing the internet of behalf of multiple network devices.

However, for security reasons not all routers can be exposed to the internet and so the idea of the license manager. To be noted the license manager can even be hosted by your partner / reseller. ( note I may be wrong here)

Happy New Year

Hope to help

Giuseppe

[salemmahara]

Hello @Giuseppe Larosa ,

I've chosen replies as helpful, but forgot to do for the rest. It's done now and thanks a million for recalling me .

@Georg Pauwen 's answer is really complete and deserves "Solution Mark".

Know, I have a really strange questions. I found the problem in connection between routers is "ARP Incomplete". Although all routers are connected through a L2 Cisco switch, 3 of them are not able to resolve others' MAC, so they are not able to pass traffic to each other. I've solved this problem with static ARP binding in configuration. But, have you ever faced with such problem?