2

The full topology is on page 7 I do not understand why the NAT boxes are only connected to edge. Why not have links from core to edge carrying traffic without NAT and links from core to A10 then to edge for traffic requiring edge?

The current core architecture is illustrated in Figure 7. It remains a pair of Cisco Nexus 7010s, the border a pair of Catalyst 6509s, some distribution/remote cores use Catalyst 6509s. NAT is provided by a pair of A10 AX3530 (primarily wireless, although an option is available for unit wired networks and forthcoming wired 802.1x initiative).

topology

  • I guess it's possible to route traffic requiring NAT to A10 with PBR, A10 sets border and gateway and border static route NAT pool to A10. This design just seems very counterintuitive. – sdaffa23fdsf Apr 13 '16 at 20:34
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 14:24
1

This is a university so most likely originally everything was on public IPs but as a result of the IP crunch there was a need to introduce private IPs.

Having the NAT at the network edge means that within the University's network traffic does not get natted. That means that internal connections within the University work just like they did in the old days when everything had a public IP.

Hooking up a couple of NAT boxes to the edge routers and adding source-address based routes to direct traffic to the correct NAT was presumablly the easiest way to introduce NAT at the network edge for traffic sourced from private subnets while allowing the traffic sourced from public IPs to continue flowing as before.


(note: any IPs used in this post are just examples and do not relate in any way to the real network the OPs diagram was taken from, I will assume that they are using 10.0.0.0/8 for private and 1.2.0.0/16 for public)

If the NAT box is attached only to border, there needs to be 2 links between each NAT box and border router, correct?

That probablly depends on the NAT implementation. I'm pretty sure iptables could do it with only a single link to the core router, other implementions may require seperate "inside" and "outside" links.

What you will need for this setup is border routers that can route based on source address (normal routing is based on destination address) so that traffic from private subnets gets directed towards the NAT while traffic from public subnets flows straight through.

Without physical constraints, isn't it better to add links for core <--> NAT <--> border while keeping current core <--> border links instead of attach the NAT boxes to border in the diagram?

I can see a few reasons why the setup they went for may be preferable to the one you propose.

Firstly I don't think you should discount physical constraints. The core and border routers may well be in different physical locations and adding an extra cable between those locations may be expensive.

Secondly I expect doing it on the border routers is actually simpler. If a packet reaches a border router it's headed out of the network. Therefore the border router can have very simple rules along the lines of "send anything with a source IP matching 10.0.0.0/9 to nat box a" and "send anything with a source IP matching 10.128.0.0/9 to nat box b". On the other hand the core routers would need more complex rules along the lines of "send anything with a source IP matching 10.0.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 1.2.0.0/16 to NAT box a" and "send anything with a source IP matching 10.128.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 1.2.0.0/16 to NAT box b".

Finally it may simply have been a case of the border routers having the needed features and the core routers not having them. Routing based on source address is a fairly advanced feature.

  • If the NAT box is attached only to border, there needs to be 2 links between each NAT box and border router, correct? Without physical constraints, isn't it better to add links for core <--> NAT <--> border while keeping current core <--> border links instead of attach the NAT boxes to border in the diagram? – sdaffa23fdsf May 15 '16 at 21:39
0

NAT is the process which translates the addresses. It should be placed at the edge of an addressing domain, where the addresses need to be translated. If you entire company uses the same addressing, it will be at the edge of the company.

If you translate addresses in the middle of an address domain, the addressing will be incorrect inside the addressing domain, and the traffic may not be routed correctly (depending on the translation direction) since the addressing domain knows nothing about the new addressing. Also, incoming traffic may have the routing problem since the edge of the addressing domain knows nothing about the foreign addressing, and it cannot route the traffic to the translation point.

  • 1
    The answer doesn't seem to be relevant to the topology in question. I was wondering why the NAT boxes are not inline (nat required: core =>nat => edge, not required: core => edge) – sdaffa23fdsf Apr 13 '16 at 20:31
  • 1
    Are you sure that the boxes representing NAT are actually representing separate devices? It could be that they represent the NAT process within the border routers. Otherwise it it just offloading the NAT process from the border router CPU into a separate box, basically keeping it at the border. – Ron Maupin Apr 13 '16 at 20:34
  • Those are standalone NAT boxes. Question updated with more details. – sdaffa23fdsf Apr 13 '16 at 20:39
  • 1
    As I wrote in my comment, the separate NAT boxes are just offloading the NAT processing from the CPUs of the border routers. They are properly placed at the edge of the addressing domain. – Ron Maupin Apr 13 '16 at 20:42
0

Its hard to say for sure without knowing the configuration. But my best guess would assume the two arrows of 20gbps links each indicate the NAT device sits "within" the edge routers. So something like:

Edge --> NAT --> Edge --> Core

This can be done using VRFs (or even VLANs). But again this is simply a guess, and no definitive answer can exist without looking at the configuration.

  • Those are standalone NAT boxes. Question updated with more details. – sdaffa23fdsf Apr 13 '16 at 20:39
  • @sdaffa23fdsf My answer (well, guess) still applies. The two connections make it so the Edge device is on either edge of the NAT device, so you get Edge > NAT > Edge. – Eddie Apr 13 '16 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.