Hi guys,
I've got a tricky one I'm trying to work out. I have 2x Cisco 2851's to provide redundancy to clients - I've configured VRRP for the LAN side as follows for both routers:
r1:
interface GigabitEthernet0/0.1
description Gi0/0.1 Office GW
encapsulation dot1Q 1 native
ip address 192.168.1.154 255.255.255.0
ip nat inside
ip virtual-reassembly
vrrp 1 description Office GW
vrrp 1 ip 192.168.1.254
vrrp 1 timers advertise msec 300
vrrp 1 preempt delay minimum 10
vrrp 1 priority 200
!
r2:
interface GigabitEthernet0/0.1
description Gi0/0.1 Office Gateway
encapsulation dot1Q 1 native
ip address 192.168.1.153 255.255.255.0
ip nat inside
ip virtual-reassembly
vrrp 1 description Office Gateway
vrrp 1 ip 192.168.1.254
vrrp 1 timers advertise msec 300
vrrp 1 preempt delay minimum 10
end
All client pc's have their gateway set as 192.168.1.254 which is working nicely. The problem I am trying to work out is with the WAN ip address. Let's say for example we have a public WAN ip of 123.123.123.123:
I've been reading up that you can cheat with VRRP and use a private IP with VRRP and then just put an ip route in for the public IP. The problem here is that NAT is trying to come from the primary ip instead of 123.123.123.123. I can ping 123.123.123.123 from any of the workstations but because it's trying to use NAT with 172.15.5.1, it's not a routeable subnet so I get no internet:
r1:
interface GigabitEthernet0/0.5
description Gi0/0.5 Office WAN
encapsulation dot1Q 5
ip address 172.17.5.254 255.255.255.0
ip flow ingress
ip nat outside
ip virtual-reassembly
vrrp 5 description Office WAN
vrrp 5 ip 172.17.5.1
vrrp 5 ip 123.123.123.123 secondary
vrrp 5 timers advertise msec 300
vrrp 5 preempt delay minimum 10
vrrp 5 priority 200
no cdp enable
!
ip route 123.123.123.120 255.255.255.248 GigabitEthernet0/0.5
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0.5 overload
r2:
interface GigabitEthernet0/0.5
description Gi0/0.5 Office WAN
encapsulation dot1Q 5
ip address 172.17.5.253 255.255.255.0
ip flow ingress
ip nat outside
ip virtual-reassembly
vrrp 5 description Office WAN
vrrp 5 ip 172.17.5.1
vrrp 5 ip 123.123.123.123 secondary
vrrp 5 timers advertise msec 300
vrrp 5 preempt delay minimum 10
vrrp 5 priority 200
no cdp enable
!
ip route 123.123.123.120 255.255.255.248 GigabitEthernet0/0.5
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0.5 overload
Basically I want to use VRRP with NAT so that both routers will always use the same WAN IP of 123.123.123.123. I did try changing the config to the following which worked but the problem here is that NAT wanted to use 123.123.123.121 as the NAT source instead of 123.123.123.123. Is there any way to get it to use 123.123.123.123 as the NAT source while still using VRRP or is this too complicated for what I'm after?
interface GigabitEthernet0/0.5
description Gi0/0.5 Office WAN
encapsulation dot1Q 5
ip address 123.123.123.121 255.255.255.248
ip flow ingress
ip nat outside
ip virtual-reassembly
vrrp 5 description Office WAN
vrrp 5 ip 123.123.123.123
vrrp 5 timers advertise msec 300
vrrp 5 preempt delay minimum 10
vrrp 5 priority 200
no cdp enable
Cheers, Mike
