5

Trying to get my head round how best to achieve the above

In essence we have s speed test server that is available in the CPE's global routing table , that we would like the customer in VRF X to test against , however due to the fact that customer X is using RFC1918 in their VRF we want to nat all LAN traffic destined to the speed server only via the WAN address ( with is public) located in global table.

CPE's are ISR (881,19x1,29x1) running 15.1.4M6

Also due to the fact that we want to use this to test the speed to the broadband circuit I would if possible like to reduce the Nat effect on the cpu , but that’s is not the primary objective. in summary I am looking for a way to share the server with numerous mpls VRF that have overlapping RFC1918 addressing.

is this on the right track ?

ip nat inside source list <ACL_LAN> interface <WAN_INT> vrf <vrf-name> overload
ip route vrf <vrf-name>  <server-ip> 255.255.255.255 <Global-WAN-nexthop>
  • 1
    Have you seen this configuration (look at the "internal" router configuration)? – Mike Pennington Sep 20 '13 at 17:43
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:37
6

Summary

is this on the right track?

Yes... very similar to the link in the comment... As you mentioned, you only need to do two things...

  • Configure NAT overload on the global interface
  • Put a static route in the VRF for the speed test server...

Details

Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in VRF01.

  To Speed Test Server
  (172.16.10.5, NH 172.16.1.1)
   <-------

Fa0/0 (global table) +-----+ Fa1/0 (VRF01)             Fa0/17 +-----+
        172.16.1.200 |     | 192.0.2.1/24      192.0.2.100/24 |     |
---------------------| PE1 |----------------------------------| CE1 |
                     |     |                                  |     |
                     +-----+                                  +-----+

PE1's Config

!!! PE1 Config
!
hostname PE1
!
ip vrf VRF01
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
interface FastEthernet0/0
 description global table interface
 ip address 172.16.1.200 255.255.255.0
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
!
!
interface FastEthernet1/0
 ip vrf forwarding VRF01
 ip address 192.0.2.1 255.255.255.0
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
!
ip route vrf VRF01 172.16.10.5 255.255.255.255 172.16.1.1 global
!
!! Insert other PE1 global routing configs

CE1's config

!!! CE1 Config
!
hostname CE1
!
interface FastEthernet0/17
 switchport access vlan 11
 switchport mode access
 switchport nonegotiate
!
!
interface Vlan11
 ip address 192.0.2.100 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 192.0.2.1

Ping proof...

CE1#ping 172.16.10.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.10.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
CE1#

NAT entry...

PE1#sh ip nat trans
Pro Inside global      Inside local       Outside local      Outside global
icmp 172.16.1.200:3    192.0.2.100:3      172.16.10.5:3      172.16.10.5:3
PE1#

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.