what happens when the backup nat fails but the primary nat does not?  should there be notification of that case?  Otherwise when the primary fails after the backup fails both immediately fail.