1

I have the following topology:

2 Edge Routers - each connecting to a different ISP via eBGP advertising the same PI space

EIGRP running between the routers and switches for reachability.

On the inside interface on both edge routers, I have "ip nat inside" and on the ISP uplink interfaces, I have "ip nat outside".

I then have the following nat statements on both edge routers:

ip nat pool POOLNAME x.x.x.54 x.x.x.70 netmask 255.255.255.128
ip nat inside source list 31 pool POOLNAME overload

I can see the nat translations on both edge routers from the respective subnet configured in access-list 31 however the traffic is not actually passing to the outside.

I am also redistributing a default route from BGP into EIGRP on both edge routers.

NOTE - when I remove router2 from the equation, the traffic starts to pass via router1 perfectly fine again or if I connect ISP2 into router1, NAT'ing works as expected and passes traffic properly as well.

What would be the reason for this and how can I fix so that both edge routers are NAT'ing properly to the outside?

Thanks

Improve this question
2
  • 1
    One thing you can do is pull the NAT translation backwards in your topology to a firewall or other common interior device instead of splitting the NAT between the two edge routers.
    – John K.
    Commented Nov 8, 2016 at 18:38
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 9, 2017 at 17:09

1 Answer 1

Reset to default
1

The translation table on each router is independent from the translation table on the other router. It sounds like you have an asymmetric routing problem. You need the link between the routers to be outside interfaces so that return traffic coming into Router 1 for translation on Router 2 will pass through a Router 2 outside interface. Router 2 will not attempt to translate return traffic unless it passes through an outside interface on Router 2, and vice versa.

Edit:

Based on your comments, you may be able to set up an interface, either virtual or physical, to the other router through your network. Set the interface as an outside interface, and create static routes to all the other router's outside interfaces through that interface. That will give the route an AD of 1, and it should be preferred over any inside routes to those interfaces on the other router. You could also run iBGP across that interface.

Improve this answer
5
  • Hi Ron, the 2 edge routers are in geographically different locations so there isn't a link between them. Is there another workaround for your solution?
    – Network Samurai
    Commented Nov 8, 2016 at 18:36
  • You need to do some basic design work to eliminate asymmetric routing. Somehow, you need any traffic sent through one router to return on the same router. That may mean only advertising certain routes from each router, try using MED, etc. One router cannot translate traffic based on the translation table of the other router.
    – Ron Maupin ♦
    Commented Nov 8, 2016 at 18:39
  • @NetworkSamurai, also, you should really have some type of link between the two routerr using iBGP. Without that, there are scenarios where you could end up sending traffic to a blackhole. You can NAT based on a loopback address, although that requires public addresses for the loopbacks, and then one router will send the traffic to the other router, but it must get to the other router on an outside interface.
    – Ron Maupin ♦
    Commented Nov 8, 2016 at 18:41
  • I did initially have iBGP configured between them using loopback addresses advertised via EIGRP.. The 2 locations are in diff locations but there is fiber connecting them via various switches, etc...metro ethernet.
    – Network Samurai
    Commented Nov 8, 2016 at 18:43
  • You still need traffic destined for the other router to be received on the other router through an outside interface.
    – Ron Maupin ♦
    Commented Nov 8, 2016 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.