NAT with two outside interfaces

If you are connected to two ISPs and looking to use NAT, you might have discovered that with the “ip nat inside source” command you can only specify one outgoing interface. Since you have two outgoing interfaces, you’ll need to use a route-map to get this working. I will show you how to do this using the following topology:

NAT Two Outside Interfaces

Above we have a ‘host’ router that will be our client on the internal network. NAT is of course our NAT/PAT router and on the right we have two ISPs.

Configuration

Let’s configure the host first:

Host(config)#no ip routing 
Host(config)#ip default-gateway 192.168.12.2

First I will disable ip routing so it becomes an ordinary host device. We’ll configure the NAT router as the default gateway. Now we can configure the NAT router:

NAT(config)#ip route 0.0.0.0 0.0.0.0 192.168.23.3
NAT(config)#ip route 0.0.0.0 0.0.0.0 192.168.24.4

I will create two equal static routes, one for ISP1 and another one for ISP2. This allows us to do load balancing.

To make your default routes reliable, I can highly recommend you to configure object tracking and IP SLA.

These two static routes will allow us to perform load-balancing:

NAT#show ip route static 
S*   0.0.0.0/0 [1/0] via 192.168.24.4
               [1/0] via 192.168.23.3

With our routing operational, we can continue to configure NAT. First I’ll configure the correct inside and outside interfaces:

NAT(config)#interface fastEthernet 0/0
NAT(config-if)#ip nat inside

NAT(config)#interface fastEthernet 0/1
NAT(config-if)#ip nat outside            

NAT(config)#interface fastEthernet 1/0
NAT(config-if)#ip nat outside

Next step is to configure an access-list to determine what hosts should be NATed. I’ll make sure that the entire 192.168.12.0/24 will be translated:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 657 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

521 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: , ,


Forum Replies

  1. Hi bhargavi,

    In our lessons, we used route-map with different routing protocols for routing redistribution and/or filtering. I haven’t found a specific chapter explaining specifically about route-map in our website, but you can see how Rene has used it in different routing protocols on the following 2 lessons:

    EIGRP Route-map Filtering
    OSPF LSA Type 5 Filtering on Cisco IOS

    I can refer you also to this article from Cisco website where you can find all information needed about route-map:

    Route-map explanation from cisco.com

    Hope this can help.

  2. Hi Rene,
    NAT inside source Process, the routing is processed first then NAT.
    in the example i think we do not need the route Map. because every packet pass through the interface will be translated. the following will work.
    please correct me if wrong

    NAT(config)#ip nat inside source list 1  int fa 0/1 overload  
    NAT(config)#ip nat inside source list 1  int fa 1/0 overload 
    

  3. Hello Mahmoud!

    Your logic makes sense, however, it wouldn’t work as it should. If you insert the second command you have above, the first one will be overwritten. You require a route map in order to determine: which addresses will be NATed, which outside interface these addresses will be routed from and which NAT translation will occur.

    For a proper NAT load balancing configuration with optimized edge routing, take a look at this Cisco support document: http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/99427-ios-nat-2isp.html

    I hope this has been helpful!

    Laz

  4. Hi Laz,
    Yes its clear and thanks for the explanation.

    //BR
    Waqar

5 more replies! Ask a question or join the discussion by visiting our Community Forum