STATIC NAT AUTO FAIL OVER TWO DIFFERENT ISPs WITH TWO STATIC VLAN

[jagannath.cmcltd]

STATIC NAT AUTO FAIL OVER TWO DIFFERENT ISPs WITH TWO STATIC VLAN

 sir i have cisco 4300 router.

i want to configure STATIC NAT AUTO FAIL OVER TWO DIFFERENT ISPs WITH TWO STATIC VLAN.

my router interface details: int gig 0/0/0 , 0/0/1, 0/0/2

ISP1

customer WAN ip:162.24.159.241/30

NIB WAN ip (default gateway):172.24.159.242/30

subnet mask:255.255.255.252

LAN IP:117.197.102.217/29

subnet mask 255.255.255.248

ISP2

IP 202.142.74.79

subnet 255.255.255.248

gatway:202.142.74.70

===

internal VLAN ip

VLAN3 ip: 192.168.6.0/24

VLAN 2 ip: 192.168.7.0/24

drowing attached.

======================

my current configuration with one ISP only.

Building configuration...

Current configuration : 2058 bytes
!
! Last configuration change at 05:24:30 UTC Thu Apr 28 2022
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no service dhcp
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!

!
no aaa new-model
!
!

!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid ISR4331/K9 sn FDO2444109U
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!

!
redundancy
mode none
!
!
!
!
!
!
!
!
interface Loopback0
ip address 117.197.102.217 255.255.255.248
ip nat inside
!
interface GigabitEthernet0/0/0
ip address 192.168.14.1 255.255.255.0
ip nat inside
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 172.24.159.241 255.255.255.252
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf

negotiation auto
!
ip nat inside source list 99 interface Loopback0 overload
ip nat inside source list 102 interface Loopback0 overload
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 172.24.159.242
ip route 192.168.14.0 255.255.255.0 172.24.159.242
!
!
access-list 99 permit 192.168.14.0 0.0.0.255
!
!
!
!
control-plane
!

[MHM Cisco World]

https://community.cisco.com/t5/networking-documents/how-to-configure-static-nat-with-route-maps/ta-p/3132855

[balaji.bandi]

adding to other suggestion - check the below thread with IP SLA and failover :

https://community.cisco.com/t5/routing/dual-isp-nat-problem/td-p/818753

[Georg Pauwen]

Hello,

--> i want to configure STATIC NAT AUTO FAIL OVER TWO DIFFERENT ISPs WITH TWO STATIC VLAN.

What exactly do you mean by 'with two static Vlan' ? What is a static Vlan ? Can you give an example of what your NAT entries would look like ?

Also, the configuration of the router you have posted does not reflect anything of what you want to accomplish. Does this router support Vlan interfaces ? Is this the router that is supposed to be connected to dual ISPs ?

ISP1

customer WAN ip:162.24.159.241/30

NIB WAN ip (default gateway):172.24.159.242/30 --> is it 172 or 162 ?

subnet mask:255.255.255.252

LAN IP:117.197.102.217/29 --> which LAN is that ?

subnet mask 255.255.255.248

ISP2

IP 202.142.74.79

subnet 255.255.255.248

gatway:202.142.74.70 -->  gateway IP address is not in the same subnet

===

internal VLAN ip

VLAN3 ip: 192.168.6.0/24

VLAN 2 ip: 192.168.7.0/24

[jagannath.cmcltd]

sir this my current configuration. but internet not access from pc 192.168.14.20

ISP1:

CustomerWAN IP : 172.24.159.241/30

NIB WAN IP(Default Gateway):172.24.159.242/30

Subnet Mask: 255.255.255.252

Statis LAN IP: 117.197.102.216/29 to 117.197.202.223/29

Subnet :255.255.255.248

ISP2:

WAN IP: 202.142.74.74 to 78

255.255.255.248

Gateway:202.142.74.73

INTERNAL BRB Network: 192.168.14.1/24

Router>en
Router#sh run
Building configuration...

Current configuration : 2909 bytes
!
! Last configuration change at 13:22:13 UTC Fri Apr 29 2022
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid ISR4331/K9 sn FDO2444109U
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
!
redundancy
mode none
!
!
!
track 1 ip sla 1 reachability
!
track 2 ip sla 2 reachability
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description CONNECTION_TO_BRB_NETWORk
ip address 192.168.14.1 255.255.255.0
ip nat inside
negotiation auto
!
interface GigabitEthernet0/0/1
description CONNECTION_TO_NISC
ip address 202.142.74.75 255.255.255.248
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/2
description CONNECTION_TO_BSNL
ip address 172.24.159.241 255.255.255.252
ip nat outside
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
negotiation auto
!
ip nat inside source static 192.168.14.1 172.24.159.242 route-map BSNL_STATIC_NAT
ip nat inside source static 192.168.14.1 202.142.74.73 route-map NISC_STATIC_NAT
ip nat inside source route-map BSNL_NAT interface GigabitEthernet0/0/2 overload
ip nat inside source route-map NISC_NAT interface GigabitEthernet0/0/1 overload
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 202.142.74.73 track 1
ip route 0.0.0.0 0.0.0.0 172.24.159.242 track 2
!
!
!
ip access-list extended INTERNET-ACCESS
permit ip 192.168.14.0 0.0.0.255 any
ip sla 1
icmp-echo 202.142.74.73 source-ip 202.142.74.75
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 172.24.159.242 source-ip 172.24.159.241
ip sla schedule 2 life forever start-time now
!
!
route-map NISC_NAT permit 10
match ip address INTERNET-ACCESS
match interface GigabitEthernet0/0/1
!
route-map BSNL_NAT permit 10
match ip address INTERNET-ACCESS
match interface GigabitEthernet0/0/2
!
route-map BSNL_STATIC_NAT permit 10
match interface GigabitEthernet0/0/2
!
route-map NISC_STATIC_NAT permit 10
match interface GigabitEthernet0/0/1
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
event manager applet NISC_DOWN
event track 1 state down
action 1.0 cli command "enable"
action 2.0 cli command "clear ip nat translation forced"
event manager applet BSNL_DOWN
event track 2 state down
action 1.0 cli command "enable"
action 2.0 cli command "clear ip nat translation forced"
!
end

Router#
*Apr 29 13:26:58.830: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046
*Apr 29 13:27:29.002: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046
*Apr 29 13:27:59.403: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046
*Apr 29 13:28:30.035: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046
*Apr 29 13:29:00.196: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046
*Apr 29 13:29:30.437: %IP-4-DUPADDR: Duplicate address 202.142.74.73 on GigabitEthernet0/0/1, sourced by 0855.31a5.a046

==============================

[Georg Pauwen]

Hello,

I am not really clear on why you have configured the static NAT entries with the IP addresses of the interface as the source ?

ip nat inside source static 192.168.14.1 172.24.159.242 route-map BSNL_STATIC_NAT
ip nat inside source static 192.168.14.1 202.142.74.73 route-map NISC_STATIC_NAT

What is the purpose of these entries, what do you want to accomplish ?

[MHM Cisco World]

ip route 0.0.0.0 0.0.0.0 202.142.74.73 track 1
ip route 0.0.0.0 0.0.0.0 172.24.159.242 track 2<- remove this track if this will be backup path and config it AD to be 200

[paul driver]

Hello

For failover remove the tracking from the secondary default route and add a seed metric higher than 1
no ip route 0.0.0.0 0.0.0.0 172.24.159.242 track 2
ip route 0.0.0.0 0.0.0.0  GigabitEthernet0/0/2 172.24.159.242 5