NAT on layer 3 Switch

[terrysk68]

Good day everyone,

I have a layer 3 switch no router in the Topology with 4 vlans inter vlan routing is enable all devices can communicate between vlans.  I have a connection to the internet(that allows me to VPN into the network to get to my devices) that is managed by another team.  The team gave me a subnet to give my devices so I could access them. What information do I need from them to enable NAT so my devices can access the internet via that connection?

[Kasun Bandara]

you need to know internal subnet which need internet access and allow NAT for those subnets. check below guide

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9300-series-switches/217419-configure-and-verify-nat-on-catalyst-900.html

[terrysk68]

Thank you for the guide I will read it.

[Georg Pauwen]

Hello,

post a diagram of your topology that shows how you are connected to the Internet, and where the VPN is terminated (your PC, a VPN router ?).

Also, what switch modeldo you have ? Post the running configuration (sh run) of that switch as well.

[terrysk68]

I have a 9300 switch and I've attached a copy of the Topology... they decided to use the layer 3 switch as the way out instead of the router I guess they have their reasons.

 

[Georg Pauwen]

Hello,

-->  I have a connection to the internet(that allows me to VPN into the network to get to my devices

I am not really clear yet on what you want to accomplish. Post the running configuration (sh run) of the switch, and put a description on the outgoing interface so we can see which interface that is...

[terrysk68]

I'm trying to get my 4 subnets to get out to the internet via my connection on interface 4.  right now I have my subnets and a connection from my network team how will I route my subnets to get out to the internet.

[MHM Cisco World · Accepted solution]

the VPN will look like direct connect link, 
only config 
ip route 0.0.0.0 0.0.0.0 <VPN interface>
and the traffic from your SW will go without NATing and the other Side will do NATing.

[terrysk68]

Thank you for this nugget someone else here suggested the same thing.