2

We are trying to merge 2 networks with overlapping IP spaces: This is the configuraiton so far:

interface Tunnel1
 description VPN Port CompanyA
 ip vrf forwarding LAN
 ip address 172.18.0.79 255.255.255.0
 ip nat enable
 tunnel source GigabitEthernet0/1
 tunnel destination 1.1.1.2
 tunnel vrf DSL
end

interface GigabitEthernet0/0
 description LAN Port CompanyB
 ip vrf forwarding LAN
 ip address 172.16.1.110 255.255.0.0 secondary
 ip address 172.16.1.98 255.255.0.0
 ip nat enable
end

ip nat source static 172.16.222.110 172.16.1.110 vrf LAN
ip nat source static 172.16.1.10 172.16.168.10 vrf LAN

The idea is following:

IP_A: 172.16.222.110 (physical ServerA) IP_B: 172.16.168.10 (Virtual ServerB) IP_C: 172.16.1.10 (physical ServerB) IP_D: 172.16.1.110 (Virtual ServerA)

Server1 (IP_A) pings the virtual IP of Server2 (IP_B). On the NAT translations, IP_A gets replaced by IP_D and IP_B gets replaced by IP_C. This way, we want to mask out the IPs from both places. This should allow the 2 Servers to comunicate directly. This works so far. On the NAT router i can see the correct output while ip nat debug is enabled:

one ICPM echo from Server1 to Server2
*Feb 27 16:01:27.307: NAT: s=172.16.222.110->172.16.1.110, d=172.16.168.10 [22]
*Feb 27 16:01:27.308: NAT: s=172.16.1.110, d=172.16.168.10->172.16.1.10 [22]
one ICPM echo response from Server1 to Server2
*Feb 27 16:01:27.317: NAT: s=172.16.1.10->172.16.168.10, d=172.16.1.110 [22]
*Feb 27 16:01:27.318: NAT: s=172.16.168.10, d=172.16.1.110->172.16.222.110 [22]

Same goes for the other side. If Server2 (IP_C) Pings the virtual address from Server1 (IP_D), the translations are done in the reverse order as you might expect:

one ICPM echo from Server2 to Server1
*Feb 27 16:04:14.066: NAT: s=172.16.1.10->172.16.168.10, d=172.16.1.110 [20]
*Feb 27 16:04:14.067: NAT: s=172.16.168.10, d=172.16.1.110->172.16.222.110 [20]
one ICPM echo respnse from Server2 to Server1
*Feb 27 16:04:14.126: NAT: s=172.16.222.110->172.16.1.110, d=172.16.168.10 [20]
*Feb 27 16:04:14.127: NAT: s=172.16.1.110, d=172.16.168.10->172.16.1.10 [20]

Now comes the strange part. If all the translationsa are cleared, and i do a ping from Server2 (IP_C) to the physical IP of Server1 (IP_A), i expect the communication to fail, as the IP_A could be a device within the local network where Server2 resides. But it turns out, a dynamic NAT rule is being formed and the traffic is allowed to the other side:

*Feb 27 16:36:09.674: NAT*: s=172.16.1.10->172.16.168.10, d=172.16.222.110 [10]
*Feb 27 16:36:09.720: NAT: s=172.16.222.110, d=172.16.168.10->172.16.1.10 [10]

The NAT translations look the same as traffic was coming from the other side:

NATROUTER#show ip nat nvi translations vrf LAN
Pro Source global      Source local       Destin  local      Destin  global
icmp 172.16.168.10:3   172.16.1.10:3      172.16.222.110:3   172.16.222.110:3
--- 172.16.168.10      172.16.1.10        ---                ---
icmp 172.16.222.110:3  172.16.222.110:3   172.16.168.10:3    172.16.1.10:3
--- 172.16.1.110       172.16.222.110     ---                ---

We can see that the router responds to arp requests for this IP. Seen on Server2:

Server2#show ip arp 
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.16.1.10             -   0c52.53ee.5300  ARPA   GigabitEthernet0/0
Internet  172.16.1.98             3   0c52.5310.8300  ARPA   GigabitEthernet0/0
Internet  172.16.1.110            3   0c52.5310.8300  ARPA   GigabitEthernet0/0
Internet  172.16.222.110          0   0c52.5310.8300  ARPA   GigabitEthernet0/0

This is not optimal, as with this setup, we still would have to check if the IPs used by servers at companyA are unused by companyB. Otherwhise we would have duplicate IPs on the LAN of companyB because both, our router and potential servers with this IP will anser arp requests. Is there a possibility to disable this dynamic funktionality?

3

We can see that the router responds to arp requests for this IP.

Disable proxy ARP on the router (no ip proxy-arp) so that the router does not answer ARP for devices on a different network. Proxy ARP is a security hole that should be disabled in any case.


Cisco actually has a particular type of NAT designed for overlapping networks (outside source). See this question about that.

2
  • Bam, your single line command (config-if) fixed the issue for me. The link you sent me describes the configuration with the old ip nat inside/outside configuration. I wanted to do it with the NAT Virtual Interface (NVI) configuration instead. Thank you very much for your quick fix. – Mario Jost Feb 27 '20 at 17:30
  • Do not confuse inside/outside source NAT with the ip nat inside or ip nat outside commands. Setting the NAT for the source or destination addresses, is different, and you should be able to use that with NVI. – Ron Maupin Feb 27 '20 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.