I was researching a bit and got the following:
iOutside2
description going NATed to PIX's inside#2 ... or to edgeRouter#2's inside ... then to ISP#2
ip address 10.10.2.1 255.255.255.0
ip virtual-reassembly
ip nat outside
exit
route-map rmOutside2 permit 10
set ip next-hop 10.10.2.2
exit
ip nat pool poolOutside2 10.10.2.1 ... normal traffic should get NATed to this address
ip nat pool poolOutside2exception1 10.10.2.3 ... with a few exceptions to the following addreess; think some management ports
ip nat pool poolOutside2exception2 10.10.2.4
ip nat pool poolOutside2exception3 10.10.2.5
iOutside3
description going NATed to PIX's inside#3 ... or to edgeRouter#3's inside ... then to ISP#3
ip address 10.10.3.1 255.255.255.0
ip virtual-reassembly
ip nat outside
exit
route-map rmOutside3 permit 10
set ip next-hop 10.10.3.2
exit
ip nat pool poolOutside2 10.10.3.1 ... normal traffic should get NATed to this address
ip nat pool poolOutside3exception1 10.10.3.3 ... with a few exceptions to the following addreess; think some management ports
ip nat pool poolOutside3exception2 10.10.3.4
ip nat pool poolOutside3exception3 10.10.3.5
iInside
description IntraNet
ip address 10.10.1.0 255.255.255.0
ip policy route-map rmOutside[2|3] ... can choose only one at a time; but something better than nothing to begin with
ip virtual-reassembly
ip nat inside
exit
... now I need to actually NAT the inside to the outsides:
ip nat inside source list aclNAToutside poolOutside2 overload ... many-to-one NAT
ip nat inside source list aclNAToutside poolOutside3 overload ... many-to-one NAT
ip access-list standard aclNAToutside
permit 10.10.1.0 0.0.0.255
exit
... adding a few exceptions:
ip nat inside source list aclNAToutsideException1 poolOutside2exception1 overload ... many-to-one NAT
ip nat inside source list aclNAToutsideException1 poolOutside3exception1 overload ... many-to-one NAT
ip access-list standard aclNAToutsideException1
permit 10.10.1.X ... eq whatever
exit
... and thus far I came; ip nat only allows standard ACLs so I have no way to add an exception because for this I need an extended one
... any other way ?
ip nat inside source also accepts route-map which in turn accepts match ip address which accepts standard or extended ACLs; should I follow this path ?
... supposing I find a way to use extended ACLs with the nat command and if (a big IF) I can find a way to get the two route maps simultaneously associated with the inside interface the I can place match commands on those route maps to divert traffic as desired without any need to ping the edge routers like in those SLA scenarios which verify the availability of the target routers, because I will only be NATing to the firewall inside interfaces and what come after that is not relevant from the point of view of this private (IntraNet) router am I right ?
