I have a VMware environment in which VMs are running a simulation suite. The software used has hardcoded IP addresses, about 10-15 VMs, and we are running multiple instances of this software each in different distributed port groups. So SIM1 VM set has in VLAN10 and SIM2 has in VLAN20, etc...

This works fine, there is no need for SIM1 VMs to talk to SIM2 VMs and so on. A new requirement has popped up and I now need to be able to remotely monitor progress, manage, and share data from a physical set of machines. The management PCs will live in VLAN200 connected to a catalyst cisco switch.

I have 4x10gbe uplinks on the distributed switch. I was going to run those to some Cisco 10gbe Router (I want to keep 10gbe connectivity to the VMs, not sure exactly which model would do this) and use VRF on subinterfaces for each VLAN using that interface as the gateway and static NAT each virtual machine. So SIM1 machine1 has IP which would NAT publicly to The 4th octet would match the private vm IP and the 3rd octet would match the VLAN. So SIM2 machine1 ( would NAT to The management side could also be a subinterface on a different port and live in global or a shared VRF. To manage SIM2 machine1 I should be able to use If shared routes between the VRFs and NAT was working.

I started trying to build something similar up in GNS3 and quickly got overwhelmed. So I want to make sure my design is sane or if there is another better more sane way of dealing with the problem. Or any tips or pointers on how to accomplish this?


Edit: Added a diagram:

NAT Diagram

The idea would be that SIM1-S1 would NAT to, SIM1-S2 would NAT to, etc... SIM2-S1 would NAT to, SIM2-S2 would NAT to, etc...

  • 2
    Can you provide a simple diagram? Assuming everything is in one location, yes NAT is the way to go. I don't think you need to use VRFs, however.
    – Ron Trunk
    Commented Oct 20, 2018 at 15:05
  • Agreed. I see no point in using VRFs.
    – Tommiie
    Commented Oct 20, 2018 at 20:15
  • I edited the above post and included an image hopefully that helps make more sense of it! R1 in the diagram would be the NAT device. Subinterface f0/0.10 would be the gateway for VLAN10 with and subinterface f0/0.20 would be the gateway for VLAN20 with, etc... This is why I was thinking about VRF.
    – umhelp
    Commented Oct 20, 2018 at 20:15
  • Assuming you'll have subinterfaces fast0/0.10 and fast0/0.20 and fast0/0.nn (with their respective 802.1q tag) on that router, I doubt that it will allow you to configure overlapping IP ranges on the subinterfaces. When I tried, my C891-24X just barked: % overlaps with GigabitEthernet0/1.10. I don't see this happening without VRFs. What router model do you have there, and how many interfaces does it have? Commented Oct 20, 2018 at 20:29
  • We haven't decided on any hardware yet, but I have an ASR-1001-X to play around with and the only image I have for GNS3 is a c7200 to mess around. Either way neither of them would allow overlapping IPs.
    – umhelp
    Commented Oct 20, 2018 at 20:35

1 Answer 1


With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram you showed.

A few caveats:

  • This example assumes that the Cat-3850 may act as L3 switch and that it can route at least between directly attached subnets/vlans.
  • Cisco IOS and IOS-XE have some slight differences w/regards to NAT, especially when it comes to NATting from one VRF to another, some licensing questions may arise. I don't think that this hurts us here, though.
  • This is freehandedly composed "pseudo code", it might not be fully copy&pasteable, but it should get you towards a solution.
  • Separation of SIM environments is not being enforced; one environment can "talk" to the NAT addresses of the other(s). If that is an issue, don't set the default route in each VRF (just a static route for the managament system or its subnet), or use ZBFW on the ASR-1001

Let's start with R1 and set up the interfaces

interface fastEthernet0/0
 desc * Vmware-dSwitch *
 no ip address

interface Fasterthern0/1
 desc * Cisco-3850 Port 1* 
 no ip address

Then, you'll have to repeat the following for each SIM or sub-environment: Note that the example uses the same VLAN tag on both sides of R1. They may be different to match the VMware environment one side and the LAN environment on the other side.

! Start of per VRF or per SIMn section
! replace VRF names, dot1q tags, interface names as appropriate

vrf defintion VRF-SIM1
 address-family ipv4

interface fast0/0.10
 description * SIM1 inside subinterface *
 vrf forwarding VRF-SIM1
 encapsulation dot1q 10
 ip address
 ip nat inside

interface fast0/1.10
 description * SIM1 outside subinterface *
 vrf forwarding VRF-SIM1
 encapsulation dot1q 10
 ip address
! ip nat inside           <--- dear me! how could I copy&waste that one! (edited after comment)
 ip nat outside

ip nat inside source static vrf VRF-SIM1
ip nat inside source static vrf VRF-SIM1
ip nat inside source static vrf VRF-SIM1

ip route vrf VRF-SIM1 fast0/1.10

! End of per VRF or per SIMn section

Please note: the nat part might need some tweaking here, but since inside and outside interface are in the same VRF, I dont' think there's any more config magic needed.

Then, on the Cat3850, you'll need a set of VLANs and SVIs (interface vlan) to match the "right" side of R1:

vlan 10 

vlan 20

vlan 30

int g1/0/1
 desc * R1 fast0/1 *
 switchport mode trunk
 switchport nonegotiate
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk

interface vlan 10
 desc * transit subnet to SIM1 *  
 ip address

interface vlan 20
 desc * transit subnet to SIM2 *  
 ip address

interface vlan 30
 desc * transit subnet to SIM3 *  
 ip address
  • 1
    Your pseudo code was pretty close. I change interface fast0/1.10 to ip nat outside. The ip nat inside statements needed match-in-vrf on the end and for some reason the routes as listed didn't work but ip route vrf SIM1 did work. I had to use an L3 Extreme Networks Virtual Switch in GNS3 since I can't load up a 3850 but the principles are effectively the same.
    – umhelp
    Commented Oct 21, 2018 at 2:36
  • 1
    Single router setup in a nutshell, avoids the need for additional VLANs, SVIs and a 802.1q Trunk on the Cat3850: 1. Setup on the SIM/lab side as above, one VRF per SIM environment. 2. Each VRF-SIMn has one subif on the SIM side interface (as before) and (new) one 802.1q tagged subif on the loop cable's "left" interface. 3. Each VRF-SIMn does its own NAT thing (as before). 4. one additional VRF-FRONT has n 802.1q tagged subifs on the loop cable's "right" interface, and one single interface towards the cat3850. 5. Cat3850 needs to route the NAT IP Ranges towards VRF-FRONT. Commented Oct 21, 2018 at 19:48
  • 1
    @umhelp the single-does-it-all-router will need at least 4 interfaces/ports (proper routed ports, not ports of an integrated switch module as can be found on 800series or similar). Interface1 towards the VMware vSwitch. Interface4 towards the cat-3850, plus interface2 and interface3 connected to each other with a "loop" or "ear" cable. That loop cable has a "left" and "right" end. On it's left end, there's n subifs mapped into the n VRF-SIMn. On its right end, there's also n subinfs, all mapped to VRF-FRONT. VRF-FRONT is taking the routin role that the 3850 had before. Commented Oct 23, 2018 at 8:13
  • 1
    @umhelp depending on the given license, an IOS XE router can simulate such a loop cable with completely virtual internal pairs of interfaces called vasileft<number>/vasiright<number>. With these, you can connect VRFs without wasting interfaces and without the headache of route leaking, and still have most of the features (dynamic routing, NAT, etc). See cisco.com/c/en/us/support/docs/ip/… for examples. Commented Oct 23, 2018 at 8:19
  • 1
    @umhelp: w/regards to performance: You'll have to decide yourself if the given traffic may go through a router twice (remember that even ASRs have a platform shaper that limits overall throughput). With a loop cable, any traffic counts double against the shaper's limit. And there will be some added queuing time/latency/serialisation time (probably very low anyway, but there's applications that don't like it). These effects are probably a bit weaker when using vasileft<number>/vasiright<number> interfaces. So... I can give no recommendation for either. Commented Oct 23, 2018 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.