One can multi-home a router via object tracking, this works just fine. When NAT is added to the mix, things seem to get ugly and broken. The "ip nat inside" statement isn't applied with an access list as the argument, but rather a route-map. As soon as the ip nat statement is in use, the router can no longer be sshed to, or telneted to on either external interface. Port forwards to internal hosts continue to work. Below is an example config. If the line "ip nat inside source route-map BGC interface FastEthernet0 overload" is removed, or the line "route-map BGC permit 10", I am able to telnet/ssh to the router. Any ideas? I have tested this on various IOS revisions, currently running bleeding edge 12.4(11)XW9, but the latest in the T train behaves the same.
version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! no aaa new-model ! ! ! ! ! ! ip cef ! ! ! multilink bundle-name authenticated ! ! archive log config hidekeys ! ! ! track 1 rtr 1 reachability ! ! ! interface FastEthernet0 ip address 172.16.10.99 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet1 ip address 1.1.1.2 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet2 ! interface FastEthernet3 shutdown ! interface FastEthernet4 ! interface FastEthernet5 shutdown ! interface FastEthernet6 shutdown ! interface FastEthernet7 shutdown ! interface FastEthernet8 shutdown ! interface FastEthernet9 shutdown ! interface Dot11Radio0 no ip address shutdown speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root ! interface Dot11Radio1 no ip address shutdown speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 station-role root ! interface Vlan1 no ip address ip nat inside ip virtual-reassembly ! interface Async1 no ip address encapsulation slip ! router eigrp 1 network 192.168.1.0 auto-summary ! ip route 0.0.0.0 0.0.0.0 172.16.10.1 track 1 ip route 0.0.0.0 0.0.0.0 1.1.1.1 254 ! ! no ip http server no ip http secure-server ip nat inside source route-map BGC interface FastEthernet0 overload ip nat inside source route-map Backup interface FastEthernet1 overload ! ip sla 1 icmp-echo 172.16.10.1 timeout 1000 threshold 2 frequency 3 ip sla schedule 1 life forever start-time now ! ! ! route-map Backup permit 10 match interface FastEthernet1 ! route-map BGC permit 10 match interface FastEthernet0 ! ! ! ! control-plane ! ! line con 0 line 1 modem InOut stopbits 1 speed 115200 flowcontrol hardware line aux 0 line vty 0 4 password beans login ! ! webvpn cef end _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
