Router Failover Configuration with BGP and NAT with two ISPs

This is for the more hard core Cisco IOS users:

With multi-homed BGP you can let your router failover internet service providers. You can track their availability with SLA, or simply let BGP do its thing. The thing that had my noodle cooked however was.. IF my router decides to route to the Internet via another ISP router.. How do I make the NAT failover to the new interface interface without manual intervention? Simply creating 2 NAT statements and hoping that IOS will pick the right one will not work.

For this scenario, there is that wonderful glue technology “route-maps” that allow you to break every rule in the book. In the next configuration I am not going to abbreviate with tedious pictures and BGP or NAT commands, (I send send them to you if you want but it’s a standard setup) instead I am just going to focus on: How do I failover NAT?!


The interfaces on my Border router:

interface Ethernet0/1

description link to ISP1

ip address

ip nat outside


interface Ethernet0/2

description link to ISP2

ip address

ip nat outside


And the internal address:

interface Ethernet0/0

description link to DSW

ip address

ip nat inside


The BGP configuration to the ISPs:

router bgp 65000

bgp log-neighbor-changes

neighbor remote-as 65111

neighbor remote-as 65222

(note : the BGP routers inject a default-route with “default-information originate”)


And now.. for the NAT part, first the obligatory ACL:

ip access-list standard nat-acl





The overload statements.. with a twist:

ip nat inside source route-map ISP1 interface Ethernet0/1 overload

ip nat inside source route-map ISP2 interface Ethernet0/2 overload


And the Magic at work:

route-map ISP2 permit 10

match ip address nat-acl

match interface Ethernet0/2


route-map ISP1 permit 10

match ip address nat-acl

match interface Ethernet0/1


So… if my router prefers the E0/1 interface for default routing (towards IPS1), the route-map ISP1 matches in the NAT statement and that will activate the NAT configuration.

IF however my routers prefers the E0/2 interface (maybe ISP1 is unreachable), it will failover to the seconds NAT statement. Works like a charm!

Credit is due to this webpage, where I got the idea from!

This entry was posted in Cisco Networking and tagged . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *