EEM nat overload weirdness

[Patrick McHenry]

I've configured the EEM to bring up a backup interface. In the EEM config, I have - action A37 cli command "ip nat inside source list nat_acl interface GigabitEthernet0/2 overload". This makes g0/2 the source of the nat translations. When I fail back to the primary interface g0/0, I  have action A35 cli command "ip nat inside source list nat_acl interface GigabitEthernet0/0 overload", but it doesn't seem to take.

And when I do a "show run | i nat", I get: " ip nat inside source list nat_acl interface GigabitEthernet0/2 overload'

But the weird thing is that it still works. I have a phone and a laptop connected to it and can make calls and the laptop can traverse the Internet. Does the router just use the interface that is available?     

Any ideas why this still works and any ideas how I can get EEM to change the nat list?

Thanks, Pat.

[Patrick McHenry]

It didn't help.

mchenry(config)#int g0/0
mchenry(config-if)#no ip nat outside
mchenry(config-if)#no ip virtual-reassembly in
mchenry(config-if)#exit
mchenry(config)#no ip nat inside source list nat_acl interface GigabitEthernet$

Dynamic mapping in use, do you want to delete all entries? [no]: yes
%Error: Dynamic mapping still in use, cannot remove
mchenry(config)#

[John Blakley]

Pat,

I've tried everything that I can think of and I can't get the same result that you get. I can clear my translations with vfr configured, and I can remove the nat statement without needing to remove nat from the interface. I would recommend testing a different version of IOS if possible....

R2#sh ip nat trans

Pro Inside global      Inside local       Outside local      Outside global

tcp 10.12.0.2:54468    172.24.0.4:54468   1.1.1.1:80         1.1.1.1:80

Current configuration : 133 bytes

!

interface FastEthernet0/0

ip address 10.12.0.2 255.255.255.0

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

end

!

interface FastEthernet1/0

ip address 172.24.0.2 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

end

ip nat inside source list 101 interface FastEthernet0/0 overload

R2(config)#no ip nat inside source list 101 interface FastEthernet0/0 overload

Dynamic mapping in use, do you want to delete all entries? [no]: yes

R2(config)#do sh ip nat trans

R2(config)#

I looked for a bug in your version but was unable to find one that referenced this behavior. I'd try to change to a different version to see if you get the same issue. If you're running the latest version, you may want to downgrade. I have version 12.4(15)T14 on mine.

John

[Patrick McHenry]

I think where it was failing was the clear ip nat trans *. I put it before the nat statement and it worked but, still sometimes it would not have the correct default route. It would use the Primary interface as the default route sometimes. So, I made the Primary interface default route have a worse metric than the backup interface default route. That way when both interfaces are up(as when the primary isp goes down), the router will choose the backup interface as the default route.

It is working great now. Thanks for all your help.

This is the end config.:

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp 254

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/2 dhcp 244

event manager applet FAIL_TO_BACKUP_INTERFACE

event syslog pattern "1 ip sla 10 reachability Up->Down" maxrun 45

action A11 cli command "enable"

action A12 cli command "configure terminal"

action A13 cli command "interface tunnel0"

action A14 cli command "no tunnel source GigabitEthernet0/0"

action A15 cli command "interface tunnel 1"

action A16 cli command "no tunnel source GigabitEthernet0/0"

action A17 cli command "interface tunnel0"

action A18 cli command "tunnel source GigabitEthernet0/2"

action A19 cli command "interface tunnel 1"

action A21 cli command "tunnel source GigabitEthernet0/2"

action A22 cli command "exit"

action A23 cli command "no ip ftp source-interface GigabitEthernet0/0"

action A24 cli command "no ip tftp source-interface GigabitEthernet0/0"

action A25 cli command "no ip http client source-interface GigabitEthernet0/0"

action A26 cli command "no ip radius source-interface GigabitEthernet0/0"

action A27 cli command "no logging source-interface GigabitEthernet0/0"

action A28 cli command "ip ftp source-interface GigabitEthernet0/2"

action A29 cli command "ip tftp source-interface GigabitEthernet0/2"

action A31 cli command "ip http client source-interface GigabitEthernet0/2"

action A32 cli command "ip radius source-interface GigabitEthernet0/2"

action A33 cli command "logging source-interface GigabitEthernet0/2"

action A34 cli command "exit"

action A35 cli command "clear ip nat trans *"

action A36 cli command "config t"

action A37 cli command "no ip nat inside source list nat_acl interface GigabitEthernet0/0 overload"

action A38 cli command "yes"

action A39 cli command "interface GigabitEthernet0/0"

action A41 cli command "shut"

action A42 cli command "interface GigabitEthernet0/2"

action A43 cli command "no shut"

action A44 cli command "ip nat inside source list nat_acl interface GigabitEthernet0/2 overload"

action A45 cli command "no ip route 0.0.0.0 0.0.0.0 dhcp"

action A46 cli command "ip route 0.0.0.0 0.0.0.0 dhcp"

action A47 cli command "interface GigabitEthernet0/0"

action A48 cli command "no shut"

action A49 cli command "exit"

!

event manager applet FAIL_Back_TO_PRIMARY_INTERFACE

event syslog pattern "1 ip sla 10 reachability Down->Up" maxrun 45

action A11 cli command "enable"

action A12 cli command "configure terminal"

action A13 cli command "interface tunnel0"

action A14 cli command "no tunnel source GigabitEthernet0/2"

action A15 cli command "interface tunnel 1"

action A16 cli command "no tunnel source GigabitEthernet0/2"

action A17 cli command "interface tunnel0"

action A18 cli command "tunnel source GigabitEthernet0/0"

action A19 cli command "interface tunnel 1"

action A21 cli command "tunnel source GigabitEthernet0/0"

action A22 cli command "exit"

action A23 cli command "no ip ftp source-interface GigabitEthernet0/2"

action A24 cli command "no ip tftp source-interface GigabitEthernet0/2"

action A25 cli command "no ip http client source-interface GigabitEthernet0/2"

action A26 cli command "no ip radius source-interface GigabitEthernet0/2"

action A27 cli command "no logging source-interface GigabitEthernet0/2"

action A28 cli command "ip ftp source-interface GigabitEthernet0/0"

action A29 cli command "ip tftp source-interface GigabitEthernet0/0"

action A31 cli command "ip http client source-interface GigabitEthernet0/0"

action A32 cli command "exit"

action A33 cli command "clear ip nat trans *"

action A34 cli command "config t"

action A35 cli command "no ip nat inside source list nat_acl interface GigabitEthernet0/2 overload"

action A36 cli command "yes"

action A37 cli command "interface GigabitEthernet0/2"

action A38 cli command "shut"

action A39 cli command "exit"

action A41 cli command "ip nat inside source list nat_acl interface GigabitEthernet0/0 overload"

action A42 cli command "ip radius source-interface GigabitEthernet0/0"

action A43 cli command "logging source-interface GigabitEthernet0/0"

action A44 cli command "no ip route 0.0.0.0 0.0.0.0 dhcp"

action A45 cli command "ip route 0.0.0.0 0.0.0.0 dhcp"

action A46 cli command "exit"

[John Blakley]

Glad to see you got it fixed!