1
                   DST Host
                    |
                    |
             +-------------+
             |             |
             |    RTR3     |
             |             |
             +-------------+
              |           |
              |           |
             RTR1--------RTR2
               | e0       |e1
               |          |
               | e0       |e1
  (Loopback1) SW1        SW2 (loopback2)
                          |
                          |
                         SRC HOST

In the above topology, SW1 and SW2 are running ospf on e0 and e1 interfaces. They are also running ospf passive on Loopback 1 and Loopback2. RTR1 and RTR2 are also running OSPF on e0 and e1. Let's say SRC HOST is sending data to DST HOST. I want to apply a NAT rule in SW2 such that packet destined to DST HOST shall have its Source IP translated to Loopback1's IP address. Will this packet reach DST HOST? Can any of the following happen with this packet: 1. Can RTR2 drop this packet? 2. Can this packet trigger an incorrect learning in RTR2's L2 table such that RTR2 thinks to reach nexthop, SW1' e0 IP address, destination mac is SW2's e1's MAC?

Thanks in advance.

2
  • What are the network device models? Most switches cannot do NAT, even if they are layer-3 switches, and layer-2 switches do not even look at layer-3 (IP) addresses.
    – Ron Maupin
    May 25 '17 at 13:57
  • Hello Ron, the SW1 and SW2 can be cat3k and RTR1 and RTR2 can be N9K standalone. Both are Cisco products. I do not have the topology in hand. I am evaluating if a certain deployment scenario has any issues with it.
    – NeilB
    May 25 '17 at 14:01
0

If you are using Cisco switches, then you certainly cannot do NAT on them. Cisco claims NAT requires hardware assist, and it only provides that on routers.

Also, when you NAT a source address, that sets the return traffic to that destination. If the traffic from Switch 2 gets a source address of Switch 1's loopback, any return traffic will be directed to Switch 1's loopback, and Switch 1 has no idea what to do with that traffic, so it gets dropped.

It sounds like you want Switches 1 and 2 to share a NAT table, but it doesn't work that way. The translated traffic will need to be returned to the device that has the translation table in order to get a reverse translation and be sent back to the correct device.

You also seem to be confusing the layer-2 (MAC) addressing with the layer-3 (IP) addressing. Layer-2 switches will switch traffic only based on the MAC address in the frame header; they do not look into the frame to even see the layer-3 address in the packet header. Routers will strip off the frame, losing the MAC address, in order to get to the layer-3 packet, and they make their routing decisions based on the layer-3 desitation address, creating a new frame for the new interface in the path toward the destination.

Since you want to use NAT to change the source address, the destination host will use that address as the destination address for any return traffic, and a host on one network has no idea what the original layer-2 address was.

2
  • Thank you Ron. I have a question on the reverse traffic from DST from SRC. Let's say after NAT, src ip of the packet is 10.10.10.1. Hence the reverse traffic will have destination as 10.10.10.1. However via OSPF, SW1 had advertised 10.10.10.1 via e0. So packet with dst ip 10.10.10.1 always reaches RTR1 and from there it will reach SW1 only. Is that not right? Why does packet with dst ip 10.10.10.1 reach SW2? Could you please explain?
    – NeilB
    May 25 '17 at 17:02
  • What I was explaining is that the routing happens based on the destination IP address. If the routing toward the destination IP address does not pass through the device with the NAT table, it will be delivered to the wrong device. The return packet will go to Switch 1, where it will be dropped because Switch 1 has no idea what to do with it.
    – Ron Maupin
    May 25 '17 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.