Good afternoon,
I am having an issue in a newly configured environment that I have setup configured for failover using vrrp on to cisco 1921 routers with ios 15.2.
My data center requires that I use BGP for the WAN side inbound connections and I am using VRRP in my network for outbound connection failover.
VRRP and BGP both appear to work as designed. If I shut down one router the BGP announced network path fails over to the failover router as expected.
Internally the secondary router will pickup the master VRRP address.
The problem that I am having is with NAT.
Static NAT connections will come in through the active router but for some odd reason are being sent out the failover router.
The same thing occurs with NAT overloading connections.
Some users accessing the internet can access the internet fine while others cannot at all.
This is because their traffic detined for the virtual IP address gateway is going to both routers.
Well the problem with this scenario is that the failover router doesn't have the announced IP route unless the primary fails.
sh vrrp brief on the master shows this router as the master and sh vrrp brief on the backup show this router as the backup.
So why on earth is any outbound traffic ever going to the backup router??? I'm pulling my hair out on this one.
I spent last night changing all of my NAT configurations to use stateful NAT with a redudancy group and I thought that it was fixed but then this morning people went into the office and had the same problem.
It would make sense to me if the backup router showed master or something but it doesn't. ARP tables are correct and everything.
I do not want to use HSRP because I don't want to waste any more IP addresses in my inside global scope. I have variably subnetted my global network into seperate VLANS and /30's /29's and so forth.
My configs are very lengthy should I post them publicly? Editing all of the IP's out will be very complex.
Any help is greatly appreciated. I am tearing my hair out here.
