8

I have a VMware environment in which VMs are running a simulation suite. The software used has hardcoded IP addresses, about 10-15 VMs, and we are running multiple instances of this software each in different distributed port groups. So SIM1 VM set has 192.168.1.0/24 in VLAN10 and SIM2 has 192.168.1.0/24 in VLAN20, etc...

This works fine, there is no need for SIM1 VMs to talk to SIM2 VMs and so on. A new requirement has popped up and I now need to be able to remotely monitor progress, manage, and share data from a physical set of machines. The management PCs will live in VLAN200 connected to a catalyst cisco switch.

I have 4x10gbe uplinks on the distributed switch. I was going to run those to some Cisco 10gbe Router (I want to keep 10gbe connectivity to the VMs, not sure exactly which model would do this) and use VRF on subinterfaces for each VLAN using that interface as the gateway and static NAT each virtual machine. So SIM1 machine1 has IP 192.168.1.2 which would NAT publicly to 10.0.10.2. The 4th octet would match the private vm IP and the 3rd octet would match the VLAN. So SIM2 machine1 (192.168.1.2) would NAT to 10.0.20.2. The management side could also be a subinterface on a different port and live in global or a shared VRF. To manage SIM2 machine1 I should be able to use 10.0.20.2. If shared routes between the VRFs and NAT was working.

I started trying to build something similar up in GNS3 and quickly got overwhelmed. So I want to make sure my design is sane or if there is another better more sane way of dealing with the problem. Or any tips or pointers on how to accomplish this?

Thanks!

Edit: Added a diagram:

NAT Diagram

The idea would be that SIM1-S1 would NAT to 10.0.10.2, SIM1-S2 would NAT to 10.0.10.3, etc... SIM2-S1 would NAT to 10.0.20.2, SIM2-S2 would NAT to 10.0.20.3, etc...

  • 2
    Can you provide a simple diagram? Assuming everything is in one location, yes NAT is the way to go. I don't think you need to use VRFs, however. – Ron Trunk Oct 20 '18 at 15:05
  • Agreed. I see no point in using VRFs. – Tommiie Oct 20 '18 at 20:15
  • I edited the above post and included an image hopefully that helps make more sense of it! R1 in the diagram would be the NAT device. Subinterface f0/0.10 would be the gateway for VLAN10 with 192.168.1.254 and subinterface f0/0.20 would be the gateway for VLAN20 with 192.168.1.254, etc... This is why I was thinking about VRF. – umhelp Oct 20 '18 at 20:15
  • Assuming you'll have subinterfaces fast0/0.10 and fast0/0.20 and fast0/0.nn (with their respective 802.1q tag) on that router, I doubt that it will allow you to configure overlapping IP ranges on the subinterfaces. When I tried, my C891-24X just barked: % 192.168.1.254 overlaps with GigabitEthernet0/1.10. I don't see this happening without VRFs. What router model do you have there, and how many interfaces does it have? – Marc 'netztier' Luethi Oct 20 '18 at 20:29
  • We haven't decided on any hardware yet, but I have an ASR-1001-X to play around with and the only image I have for GNS3 is a c7200 to mess around. Either way neither of them would allow overlapping IPs. – umhelp Oct 20 '18 at 20:35
7

With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram you showed.

A few caveats:

  • This example assumes that the Cat-3850 may act as L3 switch and that it can route at least between directly attached subnets/vlans.
  • Cisco IOS and IOS-XE have some slight differences w/regards to NAT, especially when it comes to NATting from one VRF to another, some licensing questions may arise. I don't think that this hurts us here, though.
  • This is freehandedly composed "pseudo code", it might not be fully copy&pasteable, but it should get you towards a solution.
  • Separation of SIM environments is not being enforced; one environment can "talk" to the NAT addresses of the other(s). If that is an issue, don't set the default route in each VRF (just a static route for the managament system or its subnet), or use ZBFW on the ASR-1001

Let's start with R1 and set up the interfaces

interface fastEthernet0/0
 desc * Vmware-dSwitch *
 no ip address

interface Fasterthern0/1
 desc * Cisco-3850 Port 1* 
 no ip address

Then, you'll have to repeat the following for each SIM or sub-environment: Note that the example uses the same VLAN tag on both sides of R1. They may be different to match the VMware environment one side and the LAN environment on the other side.

!
! Start of per VRF or per SIMn section
!
! replace VRF names, dot1q tags, interface names as appropriate

vrf defintion VRF-SIM1
 address-family ipv4
 exit-address-family

interface fast0/0.10
 description * SIM1 inside subinterface *
 vrf forwarding VRF-SIM1
 encapsulation dot1q 10
 ip address 192.168.1.254 255.255.255.0
 ip nat inside

interface fast0/1.10
 description * SIM1 outside subinterface *
 vrf forwarding VRF-SIM1
 encapsulation dot1q 10
 ip address 10.0.10.1
! ip nat inside           <--- dear me! how could I copy&waste that one! (edited after comment)
 ip nat outside

ip nat inside source static 192.168.1.2 10.0.10.2 vrf VRF-SIM1
ip nat inside source static 192.168.1.3 10.0.10.3 vrf VRF-SIM1
ip nat inside source static 192.168.1.4 10.0.10.4 vrf VRF-SIM1

ip route vrf VRF-SIM1 0.0.0.0 0.0.0.0 fast0/1.10 10.0.10.254

!
! End of per VRF or per SIMn section
!

Please note: the nat part might need some tweaking here, but since inside and outside interface are in the same VRF, I dont' think there's any more config magic needed.

Then, on the Cat3850, you'll need a set of VLANs and SVIs (interface vlan) to match the "right" side of R1:

vlan 10 
 name SIM1-TRANSIT

vlan 20
 name SIM2-TRANSIT

vlan 30
 name SIM3-TRANSIT

int g1/0/1
 desc * R1 fast0/1 *
 switchport mode trunk
 switchport nonegotiate
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk

interface vlan 10
 desc * transit subnet to SIM1 *  
 ip address 10.0.10.254 255.255.255.0

interface vlan 20
 desc * transit subnet to SIM2 *  
 ip address 10.0.20.254 255.255.255.0

interface vlan 30
 desc * transit subnet to SIM3 *  
 ip address 10.0.30.254 255.255.255.0
  • 1
    Your pseudo code was pretty close. I change interface fast0/1.10 to ip nat outside. The ip nat inside statements needed match-in-vrf on the end and for some reason the routes as listed didn't work but ip route vrf SIM1 0.0.0.0 0.0.0.0 10.0.10.254 did work. I had to use an L3 Extreme Networks Virtual Switch in GNS3 since I can't load up a 3850 but the principles are effectively the same. – umhelp Oct 21 '18 at 2:36
  • 1
    Single router setup in a nutshell, avoids the need for additional VLANs, SVIs and a 802.1q Trunk on the Cat3850: 1. Setup on the SIM/lab side as above, one VRF per SIM environment. 2. Each VRF-SIMn has one subif on the SIM side interface (as before) and (new) one 802.1q tagged subif on the loop cable's "left" interface. 3. Each VRF-SIMn does its own NAT thing (as before). 4. one additional VRF-FRONT has n 802.1q tagged subifs on the loop cable's "right" interface, and one single interface towards the cat3850. 5. Cat3850 needs to route the NAT IP Ranges towards VRF-FRONT. – Marc 'netztier' Luethi Oct 21 '18 at 19:48
  • 1
    @umhelp the single-does-it-all-router will need at least 4 interfaces/ports (proper routed ports, not ports of an integrated switch module as can be found on 800series or similar). Interface1 towards the VMware vSwitch. Interface4 towards the cat-3850, plus interface2 and interface3 connected to each other with a "loop" or "ear" cable. That loop cable has a "left" and "right" end. On it's left end, there's n subifs mapped into the n VRF-SIMn. On its right end, there's also n subinfs, all mapped to VRF-FRONT. VRF-FRONT is taking the routin role that the 3850 had before. – Marc 'netztier' Luethi Oct 23 '18 at 8:13
  • 1
    @umhelp depending on the given license, an IOS XE router can simulate such a loop cable with completely virtual internal pairs of interfaces called vasileft<number>/vasiright<number>. With these, you can connect VRFs without wasting interfaces and without the headache of route leaking, and still have most of the features (dynamic routing, NAT, etc). See cisco.com/c/en/us/support/docs/ip/… for examples. – Marc 'netztier' Luethi Oct 23 '18 at 8:19
  • 1
    @umhelp: w/regards to performance: You'll have to decide yourself if the given traffic may go through a router twice (remember that even ASRs have a platform shaper that limits overall throughput). With a loop cable, any traffic counts double against the shaper's limit. And there will be some added queuing time/latency/serialisation time (probably very low anyway, but there's applications that don't like it). These effects are probably a bit weaker when using vasileft<number>/vasiright<number> interfaces. So... I can give no recommendation for either. – Marc 'netztier' Luethi Oct 23 '18 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.