I have this peculiar problem and I hope somebody could shed some light onto it.
I was running out of public IP addresses, so I ordered a new /27 range from the ISP, so I could do more NAT, but somehow I am failing to make it work. Really looking for some help.
The topology is as follows:
Internet --> L2 switch --> Router (NAT) --> L3 switch --> Server
The config I have is as follows:
Router:
interface GigabitEthernet0/0/0.423
description *** VPN LINK ***
encapsulation dot1Q 423
ip vrf forwarding INTERNET
ip address X.X.X.163 255.255.255.240
crypto map CM
end
interface GigabitEthernet0/0/2.423
description *** NAT/INTERNET LINK ***
encapsulation dot1Q 423
ip address X.X.X.162 255.255.255.240
ip nat outside
end
ip route vrf INTERNET 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0.423 X.X.X.161
ip route vrf INTERNET Y.Y.Y.192 255.255.255.224 Null0 name **NEW_RANGE**
!
!
--->> natting that works:
ip nat pool Client_1_Address X.X.X.164 X.X.X.164 prefix-length 28
ip nat pool Client_2_Address X.X.X.165 X.X.X.165 prefix-length 28
ip nat inside source list RFC pool Client_1_Address vrf CUST1 overload
ip nat inside source list RFC pool Client_2_Address vrf CUST2 overload
--->> natting that doesn't work:
ip nat pool Client_20_Address Y.Y.Y.192 Y.Y.Y.192 prefix-length 27
ip nat pool Client_21_Address Y.Y.Y.193 Y.Y.Y.193 prefix-length 27
ip nat inside source list RFC pool Client_20_Address vrf CUST20 overload
ip nat inside source list RFC pool Client_21_Address vrf CUST21 overload
BGP config:
router bgp NNNN1
bgp router-id vrf auto-assign
bgp log-neighbor-changes
!
address-family ipv4 vrf INTERNET
redistribute static
neighbor X.X.X.161 remote-as NNNN2
neighbor X.X.X.161 ebgp-multihop 10
neighbor X.X.X.161 update-source GigabitEthernet0/0/0.423
neighbor X.X.X.161 timers 10 30
neighbor X.X.X.161 activate
neighbor X.X.X.161 prefix-list FILTER_ROUTES in
neighbor X.X.X.161 prefix-list PUBLIC_ADDRESSES out
default-information originate
!
ip prefix-list PUBLIC_ADDRESSES seq 5 permit Y.Y.Y.192/27 le 32
ip prefix-list FILTER_ROUTES seq 5 deny 0.0.0.0/0 le 32
The ISP have confirmed that they can see the new range being advertised, and I have also tested that it works if I was to assign one of the new public IPs to a loopback on the router, but when I try to assign that address to the server and NAT it, server loses Internet connection. However, if I flick the NAT back onto the old public IP range, it works instantly.
Router#sh ip bgp vpnv4 vrf INTERNET neighbors X.X.X.161 advertised-routes
BGP table version is 61, local router ID is X.X.X.163
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: NNNN1:1 (default for vrf INTERNET) VRF Router ID X.X.X.163
*> Y.Y.Y.192/27 0.0.0.0 0 NNNN2 ?
Total number of prefixes 1
Many thanks to anybody who can offer some advice
