Also, just FYI, when our NAT wedged the first time, we could not stop it via the console. So we could not "restart" it to get it back into operation.  We literally had to bring up a new NAT instance.

I think some sort of manual intervention would basically be required if either the primary or secondary NAT goes down, so I think some form of notification would be essential.