I've having an issue getting NAT to work when the outside interface is a subinterface. I can't find any mention of this not being supported in IOS-XE on the 1001-x. It's also not mentioned at all in the IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S.
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/nat-xe-3s-book.pdf
I'm using 03.16.03.S.155-3.S3-ext
Here are the relevant parts of my config, when I change it to use a dedicated interface for the outside vice a subinterface it works as expected.
ip access-list extended NAT_TEST
permit ip host 172.16.15.10 any
!
interface GigabitEthernet0/0/4
ip address 172.16.1.2 255.255.255.0
ip nat inside
negotional auto
!
interface TenGigabitEthernet0/0/1
no ip address
ip nat outside (I've tried with and without this command on the physical inteface that supports the subinterfaces)
!
interface TenGigabitEthernet0/0/1.601
encapsulation dot1q 601
ip address a.a.a.b 255.255.255.252
ip nat outside
!
ip route 0.0.0.0 0.0.0.0 a.a.a.a
!
ip nat inside source lisit NAT_TEST interface TenGigabitEthernet0/0/1.601 overload
