I am currently working on a project for a SP and one of their requests has me stumped.
The customer wants to move to a vendor's WAN solution and for the underlay , we are using DMVPN. The end points of the DMVPN tunnel are the CPEs. Customer router, unfortunately are mostly EOS and don't support DMVPN phase 3. For services, the customer need
- Internet connection
- LAN access between central site and branches
Due to limited number of Public IPs (2x/30), we have to use Dynamic NAT. Meeting requirement 2 is proving to be challenge. The packet flow I have understood is as such :
DC's client(say 10.1.1.1/32) tries to reach Branch's client ( say 10.20.1.1)
The packet follows a default route to Customer router WHERE it is NATTed to a public IP. The outside global entry is set to 10.20.1.1 and inside global and local are :port and 10.1.1.1:port
The packet is routed to 10.20.1.1 over the DMVPN tunnel ( routing between the CPEs is established).
- 10.20.1.1 replies to with it's own address 10.20.1.1
- 10.20.1.1 is NATted at Branch customer router to the connected public IP
- This packet reaches the DC CPE over the tunnel which tries to perform a lookup in the NAT table but doesn't find any match outside global to inside local entry ( remember the source of the reply has been natted in step 5)
What has been tried
I am thinking of a solution where the NAT is done on the CPE, and we separate traffic using VRFs. CPE-PE is in a VRF INET, which is used as an underlay for DMVPN. EIGRP over DMVPN allows the Customer to access the LAN from the global RIB. A default route to the INET vrf and some leaking between INET and global allows access to Internet. The challenge here is that the outside interface would be in a VRF and this is not a typical case of VRF AWARE NAT ( where the source is in a VRF) . I tried running this on EVE, and couldn't get it to work.
I have also heard about Double NAT but can't include it into solving my problem
Any help is very much appreciated.