Octet

Dual ISP failover with a tracked default and a floating static

Cisco IOSWorking

Tasks

  1. Probe 192.0.2.53 through ISP1 every 5 seconds with IP SLA.
  2. Track the probe, waiting 10 seconds before declaring it down and 30 seconds before declaring it up.
  3. Pin the probe to ISP1 so it never leaks out ISP2.
  4. Install a tracked default via ISP1 and a floating default via ISP2 with AD 250.
  5. Translate LAN traffic to the address of whichever ISP it leaves through.
  6. Fail ISP1 upstream, confirm the failover, then restore it and confirm the failback.

Solution

  1. 1InterfacesR1
    R1 on Cisco IOS
    interface GigabitEthernet0/0/0
 description ISP1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 no shutdown
interface GigabitEthernet0/0/1
 description ISP2
 ip address 198.51.100.2 255.255.255.252
 ip nat outside
 no shutdown
interface GigabitEthernet0/0/2
 description LAN
 ip address 10.10.0.1 255.255.255.0
 ip nat inside
 no shutdown
  2. 2IP SLA probe and track objectR1
    R1 on Cisco IOS
    ip sla 1
 icmp-echo 192.0.2.53 source-interface GigabitEthernet0/0/0
 frequency 5
ip sla schedule 1 life forever start-time now
!
track 1 ip sla 1 reachability
 delay down 10 up 30

    Without ip sla schedule the probe never runs and the track stays down. Older IOS used track 1 rtr 1 reachability.

  3. 3Pin the probe, then the two defaultsR1
    R1 on Cisco IOS
    ip route 192.0.2.53 255.255.255.255 GigabitEthernet0/0/0 203.0.113.1
ip route 192.0.2.53 255.255.255.255 Null0 254
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1 name ISP1
ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 name ISP2-BACKUP

    The first /32 keeps the probe on ISP1. The Null0 /32 at AD 254 only appears if Gi0/0/0 itself goes down, so the probe is dropped instead of succeeding through ISP2 and pulling the primary back in.

  4. 4NAT per ISPR1
    R1 on Cisco IOS
    ip access-list standard LAN
 permit 10.10.0.0 0.0.0.255
!
route-map NAT-ISP1 permit 10
 match ip address LAN
 match interface GigabitEthernet0/0/0
route-map NAT-ISP2 permit 10
 match ip address LAN
 match interface GigabitEthernet0/0/1
!
ip nat inside source route-map NAT-ISP1 interface GigabitEthernet0/0/0 overload
ip nat inside source route-map NAT-ISP2 interface GigabitEthernet0/0/1 overload

    match interface in a NAT route-map matches the outgoing interface, so each flow is translated to the address of the ISP it actually uses. Flows already translated to ISP1 stay broken after failover until they time out; clear ip nat translation * right after a failover speeds that up.

Verify

R1 output
R1# show ip sla statistics 1
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Latest RTT: 6 milliseconds
Latest operation start time: 09:14:05 UTC Tue Nov 10 2026
Latest operation return code: OK
Number of successes: 87
Number of failures: 0
Operation time to live: Forever

Return code OK and successes climbing every 5 seconds.

R1 output
R1# show ip route static | begin Gateway
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      192.0.2.0/32 is subnetted, 1 subnets
S        192.0.2.53 [1/0] via 203.0.113.1, GigabitEthernet0/0/0

Only the AD 1 default is installed. The AD 250 backup waits in the config, and the probe /32 points at ISP1.

R1 output
R1# show track 1
Track 1
  IP SLA 1 reachability
  Reachability is Down
    2 changes, last change 00:00:14
  Delay up 30 secs, down 10 secs
  Latest operation return code: Timeout
  Tracked by:
    Static IP Routing 0

After shutting the loopback on ISP1, the probe times out and the track goes down about 10 seconds later. The log shows %TRACK-6-STATE: 1 ip sla 1 reachability Up -> Down.

R1 output
R1# show ip route static | begin Gateway
Gateway of last resort is 198.51.100.1 to network 0.0.0.0

S*    0.0.0.0/0 [250/0] via 198.51.100.1
      192.0.2.0/32 is subnetted, 1 subnets
S        192.0.2.53 [1/0] via 203.0.113.1, GigabitEthernet0/0/0

The floating default with AD 250 is installed. The probe route still points at ISP1, so the probe keeps testing the primary.

R1 output
R1# show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
tcp  198.51.100.2:5012     10.10.0.25:51544      192.0.2.80:443        192.0.2.80:443

New flows from PC1 are translated to ISP2's address. Bring the loopback back and, 30 seconds after the probe recovers, the AD 1 default returns.

Mistakes people make

  • Probing the ISP's gateway only. It proves the first hop, not the internet behind it.
  • Leaving out the /32 for the probe target, so the probe follows the backup default and the failover flaps.
  • Giving the backup a lower AD than the primary, so the backup carries traffic all the time.
  • One NAT rule for the LAN tied to ISP1's interface. After failover, traffic leaves ISP2 with ISP1's source address and gets no replies.
  • Forgetting delay on the track, so a few lost probes on a lossy link flap the default route.

On other platforms

A qualified next hop with a worse preference is the floating backup. Junos static routes default to preference 5. Tracking upstream reachability on an SRX uses RPM probes with ip-monitoring.

Junos
set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1
set routing-options static route 0.0.0.0/0 qualified-next-hop 198.51.100.1 preference 250

Two defaults with different metrics. The kernel never tests the path; it drops the first route only when eth0 goes down (on carrier loss the route is just flagged linkdown unless ignore_routes_with_linkdown is set), so an upstream failure needs a health check script or a routing daemon to remove it.

Linux
ip route add default via 203.0.113.1 dev eth0 metric 100
ip route add default via 198.51.100.1 dev eth1 metric 200

Say it in the interview

"A static route on Ethernet only fails when the link goes down, and ISP failures usually happen upstream. So I tie the primary default to an IP SLA probe through a track object with delays, pin the probe target to ISP1 with a /32 so it always tests the primary, and keep a floating default to ISP2 at AD 250. NAT uses a route-map per ISP that matches the outgoing interface, so translations follow the path."

Book 3.3 Internet (IP)