Nat – IOS – Nat from a VRF to WAN interface in global routing table

cisco-iosnat;vrf

Trying to get my head round how best to achieve the above

In essence we have s speed test server that is available in the CPE's global routing table , that we would like the customer in VRF X to test against , however due to the
fact that customer X is using RFC1918 in their VRF we want to nat all LAN traffic destined to the speed server only via the WAN address ( with is public) located in global table.

CPE's are ISR (881,19×1,29×1) running 15.1.4M6

Also due to the fact that we want to use this to test the speed to the broadband circuit I would if possible like to reduce the Nat effect on the cpu , but that’s is not the primary objective. in summary I am looking for a way to share the server with numerous mpls VRF that have overlapping RFC1918 addressing.

is this on the right track ? 

ip nat inside source list <ACL_LAN> interface <WAN_INT> vrf <vrf-name> overload
ip route vrf <vrf-name>  <server-ip> 255.255.255.255 <Global-WAN-nexthop>

Best Answer

Summary

is this on the right track?

Yes... very similar to the link in the comment... As you mentioned, you only need to do two things...

  • Configure NAT overload on the global interface
  • Put a static route in the VRF for the speed test server...

Details

Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in VRF01.

  To Speed Test Server
  (172.16.10.5, NH 172.16.1.1)
   <-------

Fa0/0 (global table) +-----+ Fa1/0 (VRF01)             Fa0/17 +-----+
        172.16.1.200 |     | 192.0.2.1/24      192.0.2.100/24 |     |
---------------------| PE1 |----------------------------------| CE1 |
                     |     |                                  |     |
                     +-----+                                  +-----+

PE1's Config

!!! PE1 Config
!
hostname PE1
!
ip vrf VRF01
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
interface FastEthernet0/0
 description global table interface
 ip address 172.16.1.200 255.255.255.0
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
!
!
interface FastEthernet1/0
 ip vrf forwarding VRF01
 ip address 192.0.2.1 255.255.255.0
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
!
ip route vrf VRF01 172.16.10.5 255.255.255.255 172.16.1.1 global
!
!! Insert other PE1 global routing configs

CE1's config

!!! CE1 Config
!
hostname CE1
!
interface FastEthernet0/17
 switchport access vlan 11
 switchport mode access
 switchport nonegotiate
!
!
interface Vlan11
 ip address 192.0.2.100 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 192.0.2.1

Ping proof...

CE1#ping 172.16.10.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.10.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
CE1#

NAT entry...

PE1#sh ip nat trans
Pro Inside global      Inside local       Outside local      Outside global
icmp 172.16.1.200:3    192.0.2.100:3      172.16.10.5:3      172.16.10.5:3
PE1#
Related Topic