also, I wish that `NAT_HEALTHY` would not be set until we pinged that the primary actually came up.