topic Re: Conditional NAT between different VRFs in Network Security

Conditional NAT between different VRFs

Palazsto — Wed, 23 Aug 2023 07:58:03 GMT

Hello Guys,

Does anyone tried to make conditional NAT between different VRFs and is it even supported in IOS ?

Re: Conditional NAT between different VRFs

balaji.bandi — Wed, 23 Aug 2023 08:52:47 GMT

conditional NAT between different VRFs

Can you give some example of your use case

as per i know NAT supported in VRF in IOS latest code as i know.

Re: Conditional NAT between different VRFs

Palazsto — Wed, 23 Aug 2023 09:35:06 GMT

if source address is 192.168.1.1 and the destination is 172.16.1.1 then NAT 192.168.1.1 to 10.1.1.1

Re: Conditional NAT between different VRFs

balaji.bandi — Wed, 23 Aug 2023 09:56:46 GMT

You can do that NAT in normal right - or am i missing anything here ?

Re: Conditional NAT between different VRFs

Palazsto — Wed, 23 Aug 2023 10:23:53 GMT

I think vrfs change the picture, and NVI must be involved but I don't see many docs and config guides.

Re: Conditional NAT between different VRFs

tvotna — Wed, 23 Aug 2023 15:46:42 GMT

So far as I remember, regular NAT should do: "ip nat inside source list 100 interface g0/1 vrf RED overload". RED VRF will be placed into translation entry. Responses will be accepted in any VRF, including VRF BLUE, traffic UNNATed and sent to VRF RED. This should work identically in IOS and IOS-XE. Need to be tested though. (I could never understand why docs and Cisco NAT FAQ says that NAT NVI is required to NAT between different VRFs).

If you NAT to a pool borrowed from connected subnet, you may need to add "match-in-vrf" option, otherwise GARP entry is programmed in global VRF.