We are trying to merge 2 networks with overlapping IP spaces: This is the configuraiton so far:
interface Tunnel1
description VPN Port CompanyA
ip vrf forwarding LAN
ip address 172.18.0.79 255.255.255.0
ip nat enable
tunnel source GigabitEthernet0/1
tunnel destination 1.1.1.2
tunnel vrf DSL
end
interface GigabitEthernet0/0
description LAN Port CompanyB
ip vrf forwarding LAN
ip address 172.16.1.110 255.255.0.0 secondary
ip address 172.16.1.98 255.255.0.0
ip nat enable
end
ip nat source static 172.16.222.110 172.16.1.110 vrf LAN
ip nat source static 172.16.1.10 172.16.168.10 vrf LAN
The idea is following:
IP_A: 172.16.222.110 (physical ServerA) IP_B: 172.16.168.10 (Virtual ServerB) IP_C: 172.16.1.10 (physical ServerB) IP_D: 172.16.1.110 (Virtual ServerA)
Server1 (IP_A) pings the virtual IP of Server2 (IP_B). On the NAT translations, IP_A gets replaced by IP_D and IP_B gets replaced by IP_C. This way, we want to mask out the IPs from both places. This should allow the 2 Servers to comunicate directly. This works so far. On the NAT router i can see the correct output while ip nat debug is enabled:
one ICPM echo from Server1 to Server2
*Feb 27 16:01:27.307: NAT: s=172.16.222.110->172.16.1.110, d=172.16.168.10 [22]
*Feb 27 16:01:27.308: NAT: s=172.16.1.110, d=172.16.168.10->172.16.1.10 [22]
one ICPM echo response from Server1 to Server2
*Feb 27 16:01:27.317: NAT: s=172.16.1.10->172.16.168.10, d=172.16.1.110 [22]
*Feb 27 16:01:27.318: NAT: s=172.16.168.10, d=172.16.1.110->172.16.222.110 [22]
Same goes for the other side. If Server2 (IP_C) Pings the virtual address from Server1 (IP_D), the translations are done in the reverse order as you might expect:
one ICPM echo from Server2 to Server1
*Feb 27 16:04:14.066: NAT: s=172.16.1.10->172.16.168.10, d=172.16.1.110 [20]
*Feb 27 16:04:14.067: NAT: s=172.16.168.10, d=172.16.1.110->172.16.222.110 [20]
one ICPM echo respnse from Server2 to Server1
*Feb 27 16:04:14.126: NAT: s=172.16.222.110->172.16.1.110, d=172.16.168.10 [20]
*Feb 27 16:04:14.127: NAT: s=172.16.1.110, d=172.16.168.10->172.16.1.10 [20]
Now comes the strange part. If all the translationsa are cleared, and i do a ping from Server2 (IP_C) to the physical IP of Server1 (IP_A), i expect the communication to fail, as the IP_A could be a device within the local network where Server2 resides. But it turns out, a dynamic NAT rule is being formed and the traffic is allowed to the other side:
*Feb 27 16:36:09.674: NAT*: s=172.16.1.10->172.16.168.10, d=172.16.222.110 [10]
*Feb 27 16:36:09.720: NAT: s=172.16.222.110, d=172.16.168.10->172.16.1.10 [10]
The NAT translations look the same as traffic was coming from the other side:
NATROUTER#show ip nat nvi translations vrf LAN
Pro Source global Source local Destin local Destin global
icmp 172.16.168.10:3 172.16.1.10:3 172.16.222.110:3 172.16.222.110:3
--- 172.16.168.10 172.16.1.10 --- ---
icmp 172.16.222.110:3 172.16.222.110:3 172.16.168.10:3 172.16.1.10:3
--- 172.16.1.110 172.16.222.110 --- ---
We can see that the router responds to arp requests for this IP. Seen on Server2:
Server2#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.16.1.10 - 0c52.53ee.5300 ARPA GigabitEthernet0/0
Internet 172.16.1.98 3 0c52.5310.8300 ARPA GigabitEthernet0/0
Internet 172.16.1.110 3 0c52.5310.8300 ARPA GigabitEthernet0/0
Internet 172.16.222.110 0 0c52.5310.8300 ARPA GigabitEthernet0/0
This is not optimal, as with this setup, we still would have to check if the IPs used by servers at companyA are unused by companyB. Otherwhise we would have duplicate IPs on the LAN of companyB because both, our router and potential servers with this IP will anser arp requests. Is there a possibility to disable this dynamic funktionality?
