Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

NAT - MAC Conflict

Hi Friends,

I am seeking your expert opinion to help me to troubleshoot the below scenario;

I have Internet connection in Ethernet Medium connected to a L2 Switch (Cisco 2960). I have 2 Routers (Cisco 2900). I have a webserver to be accessed from Internet. The physical IP address of the server is Private range.

I have configured Stateful NAT as below is Static NAT to using redundancy

Though HSRP is working good, when RTR-1 is down, I am not able to reach Webserver ( using RTR-2

We found in the that ISP Switch, that even when RTR-1 is down, the MAC address for is still present one pointing to RTR-1 and other pointing to RTR-2. There are 2 MAC address entries for

What is the mistake and what is the workaround. Can you help me



Everyone's tags (4)

Re: NAT - MAC Conflict

What you should do is configure hsrp on the inside as well and make your vIP the default gateway for the server. Then you'll only have one vMAC associated to the vIP address that you have assigned and you're problem should be resolved.



HTH, John *** Please rate all useful posts ***
New Member

Re: NAT - MAC Conflict

Thanks John,

Yes, I have HSRP configured in both Inside (LAN) interface and WAN interface. The problem is static nat Public IP address is resolved with MAC address of both RTR-1 and RTR-2

Hope I have explained the problem correctly

Thanks in advance



Re: NAT - MAC Conflict


Sorry for not getting back with you sooner. Okay, since you're running hsrp on the inside, how are you testing? If you're pulling the circuit leading to the ISP, the inside interface is still up. The server's default gateway is the vIP of the hsrp group and, assuming RTR-1 is the active for the group, RTR-2 never changes over to the active state for the LAN side interface but will for the WAN (if you're pulling the circuit). If that's the case, you'll need to configure ip sla and tracking for the standby group to relinquish the role of active on the lan side if the wan interface goes into standby. (More on this in a moment.)

The other issue is that you should have the same nat translation on both routers. I'll assume that you have that, so I'll put below what you can do for sla:

ip sla monitor 1

type echo protocol ipicmpecho

frequency 5

ip sla monitor schedule 1 start now life forever

track 1 rtr 1 reachability

int (This would go on the inside interface, not the outside toward ISP)

standby 1 track 1 decrement 10

The decrement command is to decrease the priority. The goal is to get the priority lower than standby for preempt to happen. Once the WAN circuit goes down, the router will know (because of the ping happening in the background) and tracking will fail. Once it fails, your outside interface will go into standby for natural causes and then you're internal will fail over because of the tracking failure. Try it out and let me know if you have any issues with it.



HTH, John *** Please rate all useful posts ***
New Member

Re: NAT - MAC Conflict

Hi John

Thank you very much for your support.You explained the IP SLA in a more precise way. I appreciate this.

IP SLA is already there. Let me explain the problem and my troubleshooting

Problem: Configured Stateful NAT for Static NAT. HSRP is in Inside (LAN). During HSRP failover, I am seeing 2 MAC address for the Same IP address one pointing to RTR-1 and other pointing to RTR-2. So, I am not able to reach the Servers behind the static NAT

New Member

Re: NAT - MAC Conflict

I see the problem... when you are doing static nat on both routers hsrp group name should be hsrp group name configured on internal (inside) nat interface...

try this:

note that after change state of hsrp on a router to active... active router will generate few ARP packets with new information in translated direction (with static inside global address and physical mac of router interface... this way it should update information on ISP router.... what sees L2 switch in ARP is i hope not relevant.