cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Community Helping Community

304
Views
0
Helpful
0
Replies
Highlighted
Beginner

CSR1000V IOS-XE 16.3.2+ NAT Outside issue

Hello!

I'm now trying to lab Outside NAT with dynamic translation to the pool on the CSR1000V and facing an issue with a static route to Outside Local address via Outside Global address not being added to the routing table on the IOS-XE 16.3.2+ (IOS-XE 16.3.1a working ok, legacy IOS working ok with the same Outside NAT config too).

NAT config is done on the 1st CSR100V and is failrly simple:

hostname nat-csr
!
interface GigabitEthernet1
 ip address 172.16.8.1 255.255.255.0
 ip nat outside
 negotiation auto
!
interface GigabitEthernet2
 ip address 172.26.1.250 255.255.255.0
 negotiation auto
!
ip access-list extended ANY-ACL
 permit ip any any
!
ip route 172.16.7.0 255.255.255.0 172.16.8.10
ip nat pool TST-POOL 172.26.2.1 172.26.2.254 netmask 255.255.255.0
ip nat inside source static tcp 172.26.1.1 23 interface GigabitEthernet1 2323
ip nat outside source list ANY-ACL pool TST-POOL add-route

2nd CSR is used for the server:

hostname server-csr
!
username cisco privilege 15 password cisco
enable password cisco
!
interface GigabitEthernet2
 ip address 172.26.1.1 255.255.255.0
 negotiation auto
!
ip route 0.0.0.0 0.0.0.0 172.26.1.250
!
line vty 0 4
 login local

And 3rd CSR is used for the client:

hostname client-csr
!
interface GigabitEthernet1
 ip address 172.26.8.10 255.255.255.0
 negotiation auto
!
interface Loopback1
 ip address 172.26.7.1 255.255.255.0
!
interface Loopback2
 ip address 172.26.7.2 255.255.255.0

Ideally (on IOS-XE 16.3.1a) when client-csr is doing `telnet 172.16.8.1 2323 /source Loopback1` the server-csr answers with the telnet and sees the incoming connection from 172.26.2.1 (1st address in the pool). On the IOS-XE 16.3.2+ the connection doesn't succeed because the nat-csr doesn't install a route to the Outside Local address via Outside Global address of the client-csr, which is required for the return traffic to the client-csr from the server-csr. This route should look like:
 172.26.2.1/32 [1/0] via 172.26.7.1
 172.26.2.2/32 [1/0] via 172.26.7.2
 etc.
Interestingly, sometimes IOS-XE 16.6.1 does install the required static route, but this not suitable for the production dpeloyment.

Everyone's tags (3)
CreatePlease to create content
Content for Community-Ad
FusionCharts will render here