0

I'm trying to get Twice-NAT working on a Cisco 3548 switch. I have a VRF set up with 2 L3 ports on it -

  • Eth1/33 has ip address 20.20.255.250/16 and is nat inside
  • Eth1/34 has ip address 10.10.1.211/24 and is nat outside

Full config of the interfaces:

switch1# show running-config int eth1/33-34

!Command: show running-config interface Ethernet1/33-34
!Running configuration last done at: Fri Jan  5 18:23:25 2024
!Time: Fri Jan  5 18:41:06 2024

version 9.3(9) Bios:version 5.5.0 

interface Ethernet1/33
  description TO_INSIDE
  no cdp enable
  no switchport
  speed 1000
  vrf member VRF_A
  ip address 20.20.255.250/16
  ip proxy-arp
  ip nat inside 

interface Ethernet1/34
  description TO_OUTSIDE
  no cdp enable
  no switchport
  speed 1000
  vrf member VRF_A
  ip address 10.10.1.211/24
  ip nat outside 

Connected directly to Eth1/33 is a device with the IP 20.20.255.253 (the "inside" device)

Connected directly to Eth1/34 is a device with the IP 10.10.1.111 (the "outside" device)

For this experiment I want to verify that I can establish a connection from the outside to the inside. Since I only need to support a single IP on each side, I'm attempting static twice-nat.

Here are the following commands I used to attempt to get this working:

ip nat inside source static 20.20.255.253 20.20.11.111 vrf VRF_A group 4 
ip nat outside source static 10.10.1.111 20.20.11.123 vrf VRF_A group 4 add-route 

And the nat translation table now looks like:

Pro Inside global      Inside local       Outside local      Outside global
any ---                ---                20.20.11.123      10.10.1.111
any 20.20.11.111      20.20.255.253     ---                ---
any 20.20.11.111      20.20.255.253     20.20.11.123      10.10.1.111

The routing for the vrf now looks like:

switch1# show ip route vrf VRF_A
IP Route Table for VRF "VRF_A"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

10.10.1.0/24, ubest/mbest: 1/0, attached
    *via 10.10.1.211, Eth1/34, [0/0], 00:17:47, direct
10.10.1.211/32, ubest/mbest: 1/0, attached
    *via 10.10.1.211, Eth1/34, [0/0], 00:17:47, local
20.20.0.0/16, ubest/mbest: 1/0, attached
    *via 20.20.255.250, Eth1/33, [0/0], 00:17:12, direct
20.20.11.123/32, ubest/mbest: 1/0
    *via 10.10.1.111%default, [1/0], 00:08:08, nat
20.20.255.250/32, ubest/mbest: 1/0, attached
    *via 20.20.255.250, Eth1/33, [0/0], 00:17:12, local

I'm now attempting to ping from the outside device with the IP 10.10.1.111 to the global IP of the inside device, 20.20.11.111. I would expect the packet to come in on eth1/34 with source IP 10.10.1.111 and destination IP 20.20.11.111, be translated to source IP 20.20.11.123 and destination 20.20.255.253, and be sent out Eth1/33.

With debug ip nat-packtrace and term mon it looks like the translation is happening, but nothing at all is egressing from eth1/33 (using tcpdump on the inside device and viewing the port counters on the switch.) The debug ip nat-packet output is below:

2024 Jan  5 18:20:59.371153 netstack: (ipnat_translate_before_routing): ipnat_get_ipaddr_and_port succeeded,                          src 10.10.1.111, sp 45438, dst 20.20.11.111, dp 0, prot1u 
2024 Jan  5 18:20:59.371204 netstack: (ipnat_translate_before_routing): Got table_id vrf(VRF_A) ctx_id: 3, tbl_id: 3, input_iod(44) need to xlate 
2024 Jan  5 18:20:59.371268 netstack: (ipnat_translate_before_routing):  ipnat_find_xlate_addr succeeded, entry: 0 20.20.11.123:0 20.20.255.253:0 0 0 0 0
2024 Jan  5 18:20:59.371289 netstack: (ipnat_translate_before_routing): ipnat_find_xlate_addr succeeded,                              nsrc 20.20.11.123, nsp 0, ndst 20.20.255.253, ndp 0, xs: 0, id: 0, ident: 58592 tcp_aware: 0
2024 Jan  5 18:20:59.371304 netstack: (ipnat_translate_before_routing): NAT fill rt_info for NetStack to route.
2024 Jan  5 18:20:59.371343 netstack: (ipnat_translate_before_routing): rt_info nh: 0.0.0.0, iod: 43, tid: 3                             local_route: FALSE attached_route: FALSE
2024 Jan  5 18:20:59.371430 netstack: (ipnat_translate_before_routing):  Packet (ident:58592) successfully translated 

Interestingly, if I remove the ip nat outside source static translation, the NATting appears to work. The destination IP is translated and the packet routed to the inside device. Debug output for the working translation is below:

2024 Jan  5 18:23:30.782098 netstack: (ipnat_translate_before_routing): ipnat_get_ipaddr_and_port succeeded,                          src 10.10.1.111, sp 12545, dst 20.20.11.111, dp 0, prot1u 
2024 Jan  5 18:23:30.782140 netstack: (ipnat_translate_before_routing): Got table_id vrf(VRF_A) ctx_id: 3, tbl_id: 3, input_iod(44) need to xlate 
2024 Jan  5 18:23:30.782180 netstack: (ipnat_translate_before_routing):  ipnat_find_xlate_addr failed, entry not found.. Finding half entry 
2024 Jan  5 18:23:30.782223 netstack: (ipnat_translate_before_routing): It's a half_entry 
2024 Jan  5 18:23:30.782243 netstack: (ipnat_translate_before_routing): ipnat_find_xlate_addr succeeded,                              nsrc 0.0.0.0, nsp 0, ndst 20.20.255.253, ndp 0, xs: 0, id: 0, ident: 59872 tcp_aware: 0
2024 Jan  5 18:23:30.782256 netstack: (ipnat_translate_before_routing): NAT don't fill rt_info for NetStack to route.
2024 Jan  5 18:23:30.782305 netstack: (ipnat_translate_before_routing): route exists for prefix: 20.20.255.253,iod:43
2024 Jan  5 18:23:30.782342 netstack: (ipnat_translate_before_routing):  updated new iod to PTREE
2024 Jan  5 18:23:30.782410 netstack: (ipnat_translate_before_routing):  Packet (ident:59872) successfully translated

Unfortunately this means that the source IP of the outside device isn't translated, which we will need for the final setup we're working towards (the inside device isn't configurable so we won't be able to tell it how to route to addresses on the outside network.)

Is there any reason the ip nat inside source static would be working, but not when I try to do twice-NAT?

show version output below:

Software
  BIOS: version 5.5.0
 NXOS: version 9.3(9)
  BIOS compile time:  12/07/2021
  NXOS image file is: bootflash:///n3500-compact.9.3.9.bin
1
  • 20.20.0.0/16 is no private address to use freely. Please observe RFC 1918.
    – Zac67
    Jan 6 at 20:03

1 Answer 1

0

The "ip nat outside" only allows on an incoming packet for the source address to be translated. It does not feature the ip nat outside destination command. The "ip nat inside" command does feature the source and the destination commands. You could switch your inside and outside commands on the interfaces.

Regards

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.