Fail over between two ISPs with IP SLA and a tracked default route

Cisco IOSWorking

R1 has two internet circuits. Send all traffic out ISP1 while ISP1 can really reach the internet, fail over to ISP2 when it cannot, and fail back when it recovers. Translate the LAN to the address of whichever ISP the traffic leaves through.

Item	Value
ISP1 link	`203.0.113.0/30`, ISP1 is `.1`, R1 Gi0/0/0 is `.2` (primary)
ISP2 link	`198.51.100.0/30`, ISP2 is `.1`, R1 Gi0/0/1 is `.2` (backup)
LAN	`10.10.0.0/24`, gateway `10.10.0.1` on Gi0/0/2
Probe target	`192.0.2.53`, a stable host inside ISP1's network, agreed with ISP1

Tasks

Address the three interfaces and mark the NAT inside and outside roles.
Create an ICMP echo probe to the target, sourced from the ISP1 interface, every 10 seconds.
Track the probe's reachability, with a 10-second delay before going down and 30 seconds before coming back up.
Pin the probe to ISP1 with a host route, and make sure it can never leak out ISP2.
Install a default route via ISP1 tied to the track, and a floating default via ISP2 with administrative distance 10.
Translate the LAN to the ISP1 address when traffic leaves via ISP1 and to the ISP2 address when it leaves via ISP2.
Test failover by breaking ISP1 upstream while the link stays up, then test failback.

Solution

1Interfaces and NAT rolesR1

R1 on Cisco IOS

interface GigabitEthernet0/0/0
 description ISP1 primary
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 no shutdown
!
interface GigabitEthernet0/0/1
 description ISP2 backup
 ip address 198.51.100.2 255.255.255.252
 ip nat outside
 no shutdown
!
interface GigabitEthernet0/0/2
 description LAN
 ip address 10.10.0.1 255.255.255.0
 ip nat inside
 no shutdown

2IP SLA probe and the track objectR1
R1 on Cisco IOS
```
ip sla 1
 icmp-echo 192.0.2.53 source-interface GigabitEthernet0/0/0
 frequency 10
ip sla schedule 1 life forever start-time now
!
track 1 ip sla 1 reachability
 delay down 10 up 30
```
The default timeout is 5,000 ms, which fits inside the 10-second frequency. delay down 10 ignores one lost probe, and delay up 30 waits for ISP1 to be stable before moving traffic back. Very old IOS 12.4 releases used ip sla monitor and track 1 rtr 1 reachability instead.
3Pin the probe to ISP1, then the default routesR1
R1 on Cisco IOS
```
ip route 192.0.2.53 255.255.255.255 203.0.113.1
ip route 192.0.2.53 255.255.255.255 Null0 250
!
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1
ip route 0.0.0.0 0.0.0.0 198.51.100.1 10
```
The host route keeps the probe on ISP1 after failover, so R1 notices when ISP1 recovers. If Gi0/0/0 goes down, that host route disappears, and the Null0 route with distance 250 takes over. The probe then fails cleanly instead of escaping through the ISP2 default and bringing the track back up.
4NAT that follows the exit interfaceR1
R1 on Cisco IOS
```
ip access-list standard NAT-LAN
 permit 10.10.0.0 0.0.0.255
!
route-map NAT-ISP1 permit 10
 match ip address NAT-LAN
 match interface GigabitEthernet0/0/0
!
route-map NAT-ISP2 permit 10
 match ip address NAT-LAN
 match interface GigabitEthernet0/0/1
!
ip nat inside source route-map NAT-ISP1 interface GigabitEthernet0/0/0 overload
ip nat inside source route-map NAT-ISP2 interface GigabitEthernet0/0/1 overload
```
In a NAT route map, match interface matches the interface the packet is routed out of. Routing decides the exit first, then the matching route map picks that ISP's address. Translations already built on ISP1's address stay in the table after a failover until they time out (the TCP default is 24 hours), so clear them with clear ip nat translation * after a failover, or accept that old sessions break.

Verify

R1 output

R1# show ip sla statistics 1
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Latest RTT: 4 milliseconds
Latest operation start time: 10:41:20 UTC Tue Nov 10 2026
Latest operation return code: OK
Number of successes: 362
Number of failures: 0
Operation time to live: Forever

Return code OK and successes climbing every 10 seconds.

R1 output

R1# show track 1
Track 1
  IP SLA 1 reachability
  Reachability is Up
    1 change, last change 01:00:12
  Delay up 30 secs, down 10 secs
  Latest operation return code: OK
  Latest RTT (millisecs) 4

The track is up and shows the configured delays.

R1 output

R1# show ip route static | begin Gateway
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      192.0.2.0/32 is subnetted, 1 subnets
S        192.0.2.53 [1/0] via 203.0.113.1

The default is via ISP1 with distance 1. The ISP2 default (distance 10) is not in the table because a better route exists. The Null0 host route is not installed either, for the same reason.

R1 output

R1# show logging | include TRACK
*Nov 10 11:02:17.431: %TRACK-6-STATE: 1 ip sla 1 reachability Up -> Down

Logged after ISP1's upstream was broken with Gi0/0/0 still up. Expect about 15 to 25 seconds from the failure to this message: up to one probe interval, the 5-second timeout and the 10-second down delay.

R1 output

R1# show ip route static | begin Gateway
Gateway of last resort is 198.51.100.1 to network 0.0.0.0

S*    0.0.0.0/0 [10/0] via 198.51.100.1
      192.0.2.0/32 is subnetted, 1 subnets
S        192.0.2.53 [1/0] via 203.0.113.1

The floating default via ISP2 is now installed. The probe's host route is still via ISP1, so R1 keeps testing ISP1 and will fail back 30 seconds after the probe succeeds again.

R1 output

R1# show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
icmp 198.51.100.2:1        10.10.0.50:1          192.0.2.80:1          192.0.2.80:1
Total number of translations: 1

A ping from PC1 during the failover is translated to ISP2's address, so the NAT route maps are working.

Mistakes people make

Probing the ISP1 gateway 203.0.113.1. That only proves the link works, and most ISP failures happen beyond it.
Leaving out the host route, or adding it without the Null0 backup. After failover the probe can escape through ISP2, succeed, and bring the track back up, so the route flaps.
Only one NAT statement, tied to ISP1. After failover, traffic leaves through ISP2 with no matching translation and goes nowhere.
No delay on the track. One lost probe moves all traffic, and a flapping ISP moves it back and forth.
Expecting existing sessions to survive. They were translated to ISP1's address and break on failover. Only new sessions move.

Say it in the interview

"An IP SLA probe pings a stable host beyond ISP1, sourced from the ISP1 interface every 10 seconds. A track object follows it with a 10-second down delay and a 30-second up delay. The default route via ISP1 carries track 1, and a floating default via ISP2 has distance 10. A host route pins the probe to ISP1, with a Null0 backup, so it can never succeed through ISP2. NAT uses one route map per ISP with match interface, so traffic always takes the address of the ISP it leaves through."

Book 3.3 Internet (IP)