How to properly load balance two ISP's and two NATs

I currently have 2800 Series router connected to CEF by Destination balanced T1's and 2ndary provider Broadband Cable.  I've configured 2 NAT out going ACL's one for each provider, and configured 3 static routes (2xt1's 1xcable).  

At this point if I enable all lines/routes I end up with failed packets leaving the router and I'm 90% sure its due to NAT being applied to the wrong line.  IE the Cable NAT applied on the T1 lines or the T1's NAT being applied to packets on the cable.
What is the proper configuration to allow for load balancing across two different providers with seperate NAT's?  IF this isn't possible what is the proper configuration to allow for failover?
In both situations I end up running into failed packet transmission and I'm unsure as to how to proceed.

I can provide any data required beyond that listed below.

Thanks,
Postie.
ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0 permanent - t1#1
ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0 permanent - t1#2
ip route 0.0.0.0 0.0.0.0 gigabitethernet0/1 10 permanent - cable
 
ip nat inside source list ECCL1 interface Loopback0 overload - T1 NAT
ip nat inside source list ECCL2 interface GigabitEthernet0/1 overload -Cable NAT
 
ip access-list standard ECCL1 - T1 NAT
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255
ip access-list standard ECCL2 - CABLE NAT
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255

Open in new window

LVL 1
PosthumousAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JFrederick29Commented:
Give this a try.  You need to use route-maps and match the outgoing interface so when traffic leaves the T1's, it is NAT'ed to a T1 IP and the same for the cable side.  The routing is fine but remove the permanent keyword from each route for failover purposes.  Replace the NAT statements with the below and add the route-maps:

Access-lists are fine:

ip access-list standard ECCL1 - T1 NAT
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255
ip access-list standard ECCL2 - CABLE NAT
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255

Add route-maps:

route-map t1 permit 10
 match ip address ECCL1
 match interface Serial0/0/0:0

route-map t1 permit 20
 match ip address ECCL1
 match interface Serial0/0/1:0

route-map cable permit 10
 match ip address ECCL2
 match interface GigabitEthernet0/1

no ip nat inside source list ECCL1 interface Loopback0 overload - Remove the existing
no ip nat inside source list ECCL2 interface GigabitEthernet0/1 overload - Remove the existing

ip nat inside source route-map t1 interface Loopback0 overload
ip nat inside source route-map cable interface GigabitEthernet0/1 overload

Remove permanent keyword from routes:

no ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0 permanent
no ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0 permanent
no ip route 0.0.0.0 0.0.0.0 gigabitethernet0/1 10 permanent

ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0
ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0
ip route 0.0.0.0 0.0.0.0 gigabitethernet0/1 10
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
PosthumousAuthor Commented:
Very nice!
Excellent sir, I'll put that information into the router tonight and see what breaks!
Will let you know as soon as I know one way or another.

post
0
PosthumousAuthor Commented:
Good evening.
With the changes as listed above I can do extended pings out all interfaces without any lost traffic.

However if I ping extended using the loopback0 interface that is translated to the T1 provided IP range, I recieve an alternating .!.!. response from the test.  
Also current continuous pings from a workstation inside the network to outside 4.2.2.2 see large amounts of failed pings, perhaps over 50%.
Pings to the router itself recieve no loss.
I removed the gigabit route and the NAT related too it and see the same data loss.

I'm reviewing ACLs now to make sure nothing else could be blocking the pings.

Thanks,
Post

Browsing on the internet and connectivity to remote sites along with incoming requests to mail server seem to be working fine. Strangely.




ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0
ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0
ip route 0.0.0.0 0.0.0.0 gigabitethernet0/1 10
 
ip nat inside source route-map cable interface GigabitEthernet0/1 overload
ip nat inside source route-map t1 interface Loopback0 overload
 
ip access-list standard ECCL1
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255
ip access-list standard ECCL2
 remark Company
 remark SDM_ACL Category=2
 permit 192.168.1.0 0.0.0.255
 
route-map t1 permit 10
 match ip address ECCL1
 match interface Serial0/0/0:0
!
route-map t1 permit 20
 match ip address ECCL1
 match interface Serial0/0/1:0
!
route-map cable permit 10
 match ip address ECCL2
 match interface GigabitEthernet0/1
 
 
 
Below is a sample ping from the PC: (actually one of the better batches)
Request timed out.
Request timed out.
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Request timed out.
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Request timed out.
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Request timed out.
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Reply from 4.2.2.2: bytes=32 time=18ms TTL=56
Request timed out.

Open in new window

0
PosthumousAuthor Commented:
Thanks for the info Working well!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.