ISP Redundancy and NAT for Internal Networks

[jfischer86]

I am sure this is a simple question to answer. We currently NAT the internal network behind one IP address that is not the same as the primary external interface of the firewall. After setting up the ISP Redundancy in Primary/Backup mode it does not work. I know it is because the Hide Nat rules I have for the internal network. If I Nat the internal network behind the gateway all is well and the redundancy works. Is there away to setup a NAT rule per ISP, meaning can I NAT behind an IP address when ISP A is active and NAT to a different IP address when ISP B is active?

Thank you

Adam

[theoracle]

The scenerio you want to achieve using 2 ISPs for redundancy can be implemented using 2 NAT rules, 2 external interfaces, and 2 external routers. This biggest issue consultants have been faced with in the past is the implementation of 2 different ip networks attempting to fail-over to the same internal hosts. However, you can using a double NAT configuration. You would need to make use of a router redundancy protocol such as HSRP or VRRP. The basic setup is this: Rule 1 says: Hide internal network behind their gateway (internal interface of FW) then NAT to external interface A on the Firewall. External interface A on Firewall connects to ethernet on external Router A, then out to ISP A. Rule 2 says: Hide internal network behind same gateway as before and NAT to external interface B on Firewall. External interface B on Firewall connects to ethernet on external router B, then out to ISP B. Each Router will store the same MAC address entries mapped to each internal host. The router redundancy protocol must be configured for primary and secondary failover. It's very important to note that you cannot have active two service providers at any given time, or else there can be severe ARP related issues.