NAT44 within an INET VRF
Last updated
Last updated
Load nat44.vpn.lab1.init.cfg
Only routers R1-R4 are used in this lab.
R2 has two customer routers in the INET VRF which are given CGNAT addresses to conserve address space. Configure NAT on R2 so that both customers are NATed to the address 100.2.2.2/32 when traffic is sent out Gi2.12.
NAT within a vrf works very similarly to normal NAT, but we must add the “match-in-vrf” keyword to the end of the ip nat inside statement. Without this, the NAT rule assumes that we want to NAT to the global VRF.
In this lab, we enable NAT inside on the links facing R3 and R4, and enable NAT outside on the link facing R1.
We then define an ACL that matches traffic sourced from the CGNAT space.
We create a NAT pool for 100.2.2.2 (since this isn’t an interface on R2) and translate packets sourced from the CGNAT space to this address. The vrf INET keyword means that the NAT source rule is matching packets sourced from the INET vrf. The match-in-vrf keyword means that the packet is routed using the same VRF table, not the global table.
Finally we need to advertise 100.2.2.2/32 to R1 so it has a return route back to R2.
R3 and R4 both have a static default route to R2. We should see that they can both ping 8.8.8.8.
R2 has two NAT translation entries. Note that this show command is VRF-agnostic. Nothing here shows that these NATs are only within the INET VRF.
NAT within a VRF is essentially the same thing as normal NAT, except you specify the VRF in the ip nat command, along with the keyword match-in-vrf.
If the NAT outside interface is in the same VRF, you use the match-in-vrf keyword. If the NAT outside interface is in the global VRF, you don’t use the keyword.
