ISP failover and PAT connections

Unanswered Question
Apr 2nd, 2009
User Badges:

Ok, so I have an 2811 router that has IOS Firewall in it. Router is doing PAT for inside hosts, and is connected to two ISPs.

Solution desired is that one of the ISPs get used as a "backup". So SLA policies go in, and voilla. It fails over and starts using the backup isp, until that backup isp comes back up (via a pingable address in their network).

The only trouble in paradise is this:

Existing PAT translations do not get cleared, and so devices that are talking constantly (such as SIP devices) always have existing translations, and thus do not appear to fail over until they somehow create a new xlate (for example, rebooting a sip device).

Is there a way, in conjunction with ip sla policies, to force a clearing of all ip nat trans * ? Or, failing that, something else I should be using to get that functionality out of this failover scenario?

Thanks in advance for your help.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
paolo bevilacqua Thu, 04/09/2009 - 13:38
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

Wasn't the magic "oer" keyword in nat statement supposed to resolve this ?

Edison Ortiz Thu, 04/09/2009 - 15:07
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

Yes, you are triggering my memory. I did a lab, which you were a thread participant, on this subject.

The problem with 'oer' is that is only available on selected trains.

I can't exactly recall if 'oer' on itself takes care of it. I believe on that lab, I had to use aggressive time-out as well.



Robert Ho Fri, 04/30/2010 - 15:56
User Badges:

am having the same issue; anyone know a fix for this?


This Discussion