Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

ISP failover and PAT connections

Ok, so I have an 2811 router that has IOS Firewall in it. Router is doing PAT for inside hosts, and is connected to two ISPs.

Solution desired is that one of the ISPs get used as a "backup". So SLA policies go in, and voilla. It fails over and starts using the backup isp, until that backup isp comes back up (via a pingable address in their network).

The only trouble in paradise is this:

Existing PAT translations do not get cleared, and so devices that are talking constantly (such as SIP devices) always have existing translations, and thus do not appear to fail over until they somehow create a new xlate (for example, rebooting a sip device).

Is there a way, in conjunction with ip sla policies, to force a clearing of all ip nat trans * ? Or, failing that, something else I should be using to get that functionality out of this failover scenario?

Thanks in advance for your help.

Hall of Fame Super Bronze

Re: ISP failover and PAT connections

You can be aggressive on the 'nat translation time-out', which by default and depending of the port can be up to 24hrs.




Hall of Fame Super Gold

Re: ISP failover and PAT connections

Wasn't the magic "oer" keyword in nat statement supposed to resolve this ?

Hall of Fame Super Bronze

Re: ISP failover and PAT connections

Yes, you are triggering my memory. I did a lab, which you were a thread participant, on this subject.

The problem with 'oer' is that is only available on selected trains.

I can't exactly recall if 'oer' on itself takes care of it. I believe on that lab, I had to use aggressive time-out as well.



New Member

Re: ISP failover and PAT connections

am having the same issue; anyone know a fix for this?

CreatePlease to create content