3

I have an odd issue with BGP+NAT. I have 2 separate routers and 2 different ISP's.

Topology looks like this:

ISP1--BGP--> RTR1 \
                     \--OSPF-- Palo Alto Firewall-- Internal Network
ISP2 ---BGP--> RTR2 /

Hope that makes sense.

So I currently have BGP and NAT working with just ISP1 on RTR1. However, when I turn up ISP2, advertise our /24, and issue the NAT commands on RTR2 as well, NAT stops working. Am I missing something here?

Thanks

3
  • 1
    Routing protocols really do not work well with NAPT. I'm trying to understand why you would use NAT in this situation if you have public addressing that you are advertising to the ISPs, why would you use NAPT? You should only use it when you must, and you do not need to when the addressing is public addressing. In any case, please edit your question to include the (sanitized) router configurations. At this point all we could do is guess what is going on, but that is off-topic here. – Ron Maupin Nov 25 '19 at 16:41
  • We only have a /24 and our internal addresses take up way more ip space than a single /24 which is why we are NAT'ing... – Network Samurai Nov 25 '19 at 23:09
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:47
6

If I understand correctly you are performing NAT for your traffic going to the Internet on RTR1 and RTR2.

If the NAT tables are not synched between those 2 routers, then if a NAT translation is performed on RTR1 for example, but the answer come through ISP2 to RTR2, then RTR2 doesn't have a NAT entry for this traffic and cannot forward it to the originating host.

The solution is either to synch NAT tables between the 2 routers (depends on the routers models) or to perform NAT on another device and only route on the BGP routers.

3
  • Yes, when I turn up the bgp session to ISP2, traffic would be going out both ISPs however I did set the local preference and did path prepending to make ISP2 less desirable but still was having issues. The routers are CIsco ISR's...didn't know you could sync NAT tables...if you could point me to any documentation, would be helpful. – Network Samurai Nov 25 '19 at 13:20
  • you can confirm the diagnostic by capturing traffic on both router and see if it is really asymmetric routing. – JFL Nov 25 '19 at 14:02
  • Found this doc: tengriengineer.blogspot.com/2017/06/… so will try this tonight – Network Samurai Nov 25 '19 at 14:57
3

If routes to the same destination end up with equal cost on the PA, it'll use ECMP to distribute traffic across both RTRs (depending on configuration), possibly using different public IPs for NAT. While this may work with some protocols (like UDP) it definitely won't with others (like TCP). TCP's SYN may go one way, and data segments the other - that can't work. Like JFL has pointed out, it could only work with synchronized NAT tables across RTR1&2.

As Jesse has suggested, moving NAT to the PA solves this issue, ideally with public IP routing between PA and RTRx (you could also use private IP links w/o NAT).

Another alternative is to use policy routing instead of ECMP, to make each session 'stick' to either RTR1 or RTR2 (unless an uplink fails).

3

If you move your NAT to the Palo Alto unit(s), you wouldn't have any issues with NAT on the ISRs, and you'd just route traffic accordingly via access segments, with whatever routing method you choose and whatever route preference or prepending you choose, to prefer one path over the other.

2
  • Tried this actually and started to get some ospf adj problems with the loopback I was using on the palo's. Kept saying an error msg in the debug's such as "x.x.x.x..src not on the same network"...didn't make much sense to me why I was getting this for a loopback interface that was a passive interface. – Network Samurai Nov 25 '19 at 14:52
  • Interesting. Have you tried with another protocol rather than OSPF? Maybe iBGP or even plain static routes with different metrics (one higher than the other) to give route preference? – Jesse P. Nov 25 '19 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.