Hi
I'm building a dual ISP failover config, which I believe I have got sorted out (second to-be-primary ISP isn't online yet to test, but the "ip sla" etc stuff is using the correct failback route).
Where I'm a bit confused is how to handle static NAT translations for services behind the router.
On my existing single ISP setup this is simple - an ip nat inside source static tcp 10.0.0.1 100 2.2.2.2 100 extendable entry along with a corresponding permit tcp any host 2.2.2.2 eq 100 ACL entry to allow the traffic inbound. This is all working.
When the second ISP comes online, I presume I will have to do a second static translation to the corresponding external IP (as I understand it "extendable" is for this exact purpose) ? In terms of the ACL, do I just create an object-group network with both external IPs in, and change the ACL to permit tcp any host object-group ISP1-ISP2-EXT-IP eq 100, or do I do each line separately, or something else entirely?
Is this the correct way to do it? e.g. the config would end up looking something like this:
object-group network ISP1-ISP2-EXT-IP
host 2.2.2.2
host 3.3.3.3
ip nat inside source static tcp 10.0.0.1 100 2.2.2.2 100 extendable
ip nat inside source static tcp 10.0.0.1 100 3.3.3.3 100 extendable
ip access-list extended INCOMING
permit tcp any object-group ISP1-ISP2-EXT-IP eq 100
Does that sound right? Thanks in advance!
