Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

NAT on a stick facing the internet (ip nat outside) interface.

Hi all,

I just came across a situation where a client had moved servers from their property to a data center and had trucks talking to a hardcoded ip address that was at their property.  So they needed to redirect the old IP to the new datacenter ip address.

I managed to get this working but found a gotcha that i watned to share.  These configs are from the test lab i used to set it up.

I will list the ip's and their uses:

Fa0/0 : 192.168.1.1 : internet interface

loopback0 : 10.22.22.22 : Doesnt matter what this actually is.

Loopback5: ignore:

traffic is coming from any ip on the internet pointed at 10.0.0.1 which should be translated to the internet address 192.168.50.1 which sits out fa0/0 by the default route.

It is not shown in this config but due to the client actually using, in this case, the 10.0.0.0/24 on the internal interface of the router i had to put a static route for 10.0.0.1 255.255.255.255 pointing to fa0/0 to make it use the nat rules to rewrite the destination.

The one issue i had was when i made the static nat rule for the outside looking at the ip packet debug the traffic coming in no longer used the PBR i had setup to force it to loop back on the loopback interface.

*Mar  1 01:25:14.699: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:25:14.699: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3
*Mar  1 01:25:14.703: IP: tableid=0, s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), routed via FIB
*Mar  1 01:25:14.703: IP: s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), len 100, sending
*Mar  1 01:25:14.707: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:25:14.707: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3
*Mar  1 01:25:14.707: IP: tableid=0, s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), routed via FIB
*Mar  1 01:25:14.707: IP: s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), len 100, sending
*Mar  1 01:25:14.719: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:25:14.719: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3
*Mar  1 01:25:14.719: IP: tableid=0, s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), routed via FIB
*Mar  1 01:25:14.719: IP: s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), len 100, sending
*Mar  1 01:25:14.723: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:25:14.723: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3
*Mar  1 01:25:14.723: IP: tableid=0, s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), routed via FIB
*Mar  1 01:25:14.723: IP: s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), len 100, sending
*Mar  1 01:25:14.731: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:25:14.731: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3
*Mar  1 01:25:14.731: IP: tableid=0, s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), routed via FIB
*Mar  1 01:25:14.731: IP: s=10.0.0.1 (local), d=10.2.2.25 (FastEthernet0/0), len 100, sending

If i was to pull out the static nat it would use the PBR and go via loopback.  Thinking about it i  put the no alias at the end of the static nat and this stopped the traffic jumping the PBR and forced it to work.

*Mar  1 01:26:07.051: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1, len 100, FIB policy match
*Mar  1 01:26:07.051: IP: tableid=0, s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via FIB
*Mar  1 01:26:07.051: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1, len 100, policy match
*Mar  1 01:26:07.051: IP: route map redirect, item 10, permit
*Mar  1 01:26:07.051: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (Loopback0), len 100, policy routed
*Mar  1 01:26:07.051: IP: FastEthernet0/0 to Loopback0 10.0.0.1
*Mar  1 01:26:07.051: IP: s=10.2.2.25 (FastEthernet0/0), d=10.0.0.1 (Loopback0), g=10.0.0.1, len 100, forward
*Mar  1 01:26:07.055: IP: tableid=0, s=10.2.2.25 (Loopback0), d=10.0.0.1 (FastEthernet0/0), routed via RIB
*Mar  1 01:26:07.055: NAT: [0] Allocated Port for 10.2.2.25 -> 192.168.1.1: wanted 45 got 45
*Mar  1 01:26:07.055: NAT: setting up outside mapping 10.0.0.1->192.168.50.1, with mapping-id 0
*Mar  1 01:26:07.055: NAT: i: icmp (10.2.2.25, 45) -> (10.0.0.1, 45) [225]    
*Mar  1 01:26:07.055: NAT: s=10.2.2.25->192.168.1.1, d=10.0.0.1 [225]
*Mar  1 01:26:07.055: NAT: s=192.168.1.1, d=10.0.0.1->192.168.50.1 [225]
*Mar  1 01:26:07.055: IP: s=192.168.1.1 (Loopback0), d=192.168.50.1 (FastEthernet0/0), g=192.168.1.2, len 100, forward
*Mar  1 01:26:07.055: NAT*: o: icmp (192.168.50.1, 45) -> (192.168.1.1, 45) [225]
*Mar  1 01:26:07.059: NAT*: s=192.168.50.1->10.0.0.1, d=192.168.1.1 [225]
*Mar  1 01:26:07.059: NAT*: s=10.0.0.1, d=192.168.1.1->10.2.2.25 [225]

Now it looks like when the router has an ip address in the alias table it will skip the PBR rules.  Not really sure on why and hoping someone might be able to enlighten me on the issue.

Cheers,

Simon

Everyone's tags (4)
1076
Views
0
Helpful
0
Replies
CreatePlease to create content