Customer with Overlapping IPs talking to DC

[Ahmed Shahzad]

Hi,

There is a scenario in which MPLS customers with overlapping IP addresses would like to access a shared resource in the Data Center. How this could be possible in MPLS?

Best Regards,
Shahzad.

[Mahesh Gohil]

Hi shahzad,

You can not achieve this because you will have common vrf for all the customer for this kind

of service.

You need separate ip schema for shared service.

Like most of the providers provide their own ip to customer for video conference, managed access, voip service etc.

You can define your own ip scheme of live public ip's (it will be within mpls domain so no need to take ip from registry)

which will ensure that it will not be used by customer and you will ensure uniqueness (like i do 13.0.0.0/16)

Hope this helps

Regards

Mahesh

[Ahmed Shahzad]

Hi Mahesh,

Thanks for your response.

I have a public IP address scheme for my shared resources, but I am concerned about the overlapping IPs from the client VPN. When I would important the client VPNs into shared VPN then how the overlapping address would be covered?

Best Regards,
Shahzad.    

[Reza Sharifi]

Shahzad,

You can use different VPNs/VRFs for each customer with overlapping IP address. This address is part of the VPN-IPv4 address family, which is a BGP address family added as an extension to the BGP protocol. In VPN-IPv4 addresses, a value that identifies the VPN, called a route distinguisher, is prefixed to the IPv4 address, providing an address that uniquely identifies a IPv4 address.

HTH

Reza

[Ahmed Shahzad]

Thanks Reza,

My questions is that how do we can allow access to shared services from multiple MPLS VPNs. Please note that multiple MPLS VPNs have the overlapping IP address. For example Customer A has 10.0.0.0/16 and Customer B has 10.0.0.0/16, and they both want to access shared resource on subnet 146.178.210.0/24. This shared resource is hosted by MPLS provider, and is hosting application like NMS.

Best Regards,
Shahzad.

[Luc De Ghein]

Hi Shahzad,

Have you considered NAT?

You could have NAT runnng inside one VRF to make the shared access with overlapping IP addresses possible.

Thanks,

Luc

[Reza Sharifi]

Shahzad,

That is one of the benefit of the MPLS/VPM, so you can have overlapping IP address.

So, in your case you need  a VRF for customer A and a VRF for customer B and each have 10.0/16 IP segments. Now, you can create a shared VRF for 146.178.210.0/24 and call it "shared" and then import from customer A and customer B to this "shared" VRF, so they can access the resources they need.

HTH

Reza

[JoeKeegan3]

Hi Raza,

I think the issue with that approach would be the return traffic. When the return packet is routed back to the customer how would the network know which customer to route back too if both are using the same source addresses?

I agree with Luc, that NAT, while not ideal is the way to solve this issue.

Best,

Joe

[Ahmed Shahzad]

Thanks Guys for your responses.

The issue is with the return traffic of customer having overlapping IP addresses.

Does anyone have a reference to design and configuration document which would cover this requirement, may be using NAT?

Cheers,

Ahmed Shahzad

Think green - keep it on the screen.

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

[Atif Awan · Accepted solution]

mshahzad@hotmail.com
Thanks Guys for your responses.
The issue is with the return traffic of customer having overlapping IP addresses.
Does anyone have a reference to design and configuration document which would cover this requirement, may be using NAT?
Cheers,
Ahmed Shahzad 
Think green - keep it on the screen.
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

NAT is the usual solution for this. NAT can be done on your PE or on an external device (such as a firewall) that interconnects MPLS domain with the shared services infrastructure. Following white paper on NAT with MPLS will provide you with enough information on how to do VRF-aware NAT:

http://www.cisco.com/en/US/partner/tech/tk648/tk361/technologies_white_paper09186a0080b40929.shtml

Atif

[Ahmed Shahzad]

Thanks guys for your support.

Best Regards,

Ahmed Shahzad.