Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have an odd issue with BGP+NAT. I have 2 separate routers and 2 different ISP's.
Topology looks like this:
ISP1--BGP--> RTR1 \
\--OSPF-- Palo Alto Firewall-- Internal Network
ISP2 ---BGP--> RTR2 /
Hope that makes sense.
So I currently have BGP and NAT working with just ISP1 on RTR1. However, when I turn up ISP2, advertise our /24, and issue the NAT commands on RTR2 as well, NAT stops working. Am I missing something here?
Thanks
If I understand correctly you are performing NAT for your traffic going to the Internet on RTR1 and RTR2.
If the NAT tables are not synched between those 2 routers, then if a NAT translation is performed on RTR1 for example, but the answer come through ISP2 to RTR2, then RTR2 doesn't have a NAT entry for this traffic and cannot forward it to the originating host.
The solution is either to synch NAT tables between the 2 routers (depends on the routers models) or to perform NAT on another device and only route on the BGP routers.
If routes to the same destination end up with equal cost on the PA, it'll use ECMP to distribute traffic across both RTRs (depending on configuration), possibly using different public IPs for NAT. While this may work with some protocols (like UDP) it definitely won't with others (like TCP). TCP's SYN may go one way, and data segments the other - that can't work. Like JFL has pointed out, it could only work with synchronized NAT tables across RTR1&2.
As Jesse has suggested, moving NAT to the PA solves this issue, ideally with public IP routing between PA and RTRx (you could also use private IP links w/o NAT).
Another alternative is to use policy routing instead of ECMP, to make each session 'stick' to either RTR1 or RTR2 (unless an uplink fails).
If you move your NAT to the Palo Alto unit(s), you wouldn't have any issues with NAT on the ISRs, and you'd just route traffic accordingly via access segments, with whatever routing method you choose and whatever route preference or prepending you choose, to prefer one path over the other.
