GRE and static NAT problem

[NemanjaPoprzen]

Hi

I have problem with the following setup:

I am using DMVPN (GRE, IPSec and EIGRP) in my network, tunnel interfaces on both routers are in the same subnet 10.64.24.0/22. Tunnels are up and functional. On R2 I have static NAT configured:

ip nat inside source static 192.168.x.x 10.64.24.x

interface fas 0/0 (inside interface)

ip nat inside

interface tunnel 0

ip address 10.64.24.y 255.255.252.0

ip nat outside

192.168.x.x is inside local IP address of PC2 and 10.64.24.x is inside global

If there is a static route on R1 : ip route 10.64.24.x 255.255.255.255 10.64.24.y then I can ping PC2 from PC1.

If there is no static route on R1, ping fails.

PC1 and R1 are part of the central location, PC2 an R2 are part of the branch location. I have 50 branch locations.

I am not sure what is the problem and I hate to mix static routing and EIGRP. Is there any other solution?

Thanks

[Latchum Naidu]

Hi,

You can redistribute the static routes into EIGRP by using the following command

router eigrp 200
redistribute static

HTH
Please click on the correct answer if this answered your question.
Regards,
Naidu.

[NemanjaPoprzen]

I forgot to mention, there are two routers on central location (R1 primary and R1 standby) so static routing and redistribution into EIGRP is not an option. Is there any kind of solution regarding ARP, proxy-ARP or something similar?

Why ICMP does not work when there is no static route?

[Latchum Naidu]

Hi,

But still you can use redistribute in one router that is not at all problem.

HTH
Please click on the correct answer if this answered your question.
Regards,
Naidu.

[NemanjaPoprzen]

Naidu

I have two routers on central location (for redundancy). R1a and R1b will have HSRP configured between them for LAN network. PC1 will have R1a as a default gateway, if R1a fails R1b will take over. Also, if R1a WAN link fails R1b will take over.

But what if primary WAN link on one branch location fails? Then branch router will use R1b as backup connection but for LAN network on central location (PC1) R1a will still be default router. R1a has static routes towards non-functional primary WAN link. He will drop the packets from PC1 to PC2, he will not forward it to R1b.

Then multiply this problem with 50+ routers (locations).

Also, It is not scalable to use 50+ static routes in combination with tracking funcionality and IP SLA.

Maybe there is some kind of NHRP tweak that can help me solve the problem?

Thanks

P.S. You need to specifiy metric when redistributing into EIGRP

[Latchum Naidu]

Hi,

What are those primary and backup links? is it MPLS and Internet?
And What protocols you are running on both links?
Are they connected to different routers at branch site?

HTH
Please click on the correct answer if this answered your question.
Regards,
Naidu.

[NemanjaPoprzen]

Primary links are leased lines and backup links are using Internet. I have DMVPN (GRE, IPSec, NHRP and EIGRP) between central routers and branch routers. On central site I use HSRP between R1a and R1b (for LAN gateway redundancy).

On branch side i have only one router, both primary and backup links are on the same branch router.

I still think I need some sort of special NHRP configuration.

regards

[Latchum Naidu]

Hi,

What protocol you are running on leased line?

I have the same kind of setup at one of my site, MPLS and Internet (dmvpn) between branch and hub site.
BGP is the protocol running on MPLS and EIGRP is on dmvpn.
We have dual hubg and dual dmvpn tunnels (2 routers at hub have dmpvn tunnels and branch have two dmvpn tunnels).

At one of my site have only one router where MPLS and internet terminated. This is a default gateway for all pc's at this site.

So the primary traffic is going on MPLS, if this primary link is down then the traffic is move on to dmvpn and still the lan pc's have default gateway.

Hope the above will make you help.

Please rate the helpfull posts.
Regards,
Naidu.

[NemanjaPoprzen]

I do not have MPLS anywhere in my network. On leased lines I have HDLC on Layer 2 and OSPF asa dymanic routing protocol. DMVPN tunnels are fully functional, in case of router failure, traffic is rerouted over backup link (of course)

But all that does not matter, problem is static NAT on branch routers and availability of those NATed IP addresses from central site LAN.

[Latchum Naidu · Accepted solution]

Hi,

You will loose NAT rules when the internet line at branch office is down and you need to make availability for thos NAT even though the internet at branch is down is that what you want?

Please rate the helpfull posts.
Regards,
Naidu.

[Marwan ALshawi · Accepted solution]

Hi there

what Naidu has told is right you need to advertise this NATed subnet to your Hub routers inorder for them to have end to end reachabilty

using a static route in the Hub is not good option if you are using HSRP a syo mentioend above

however make atatic route in the branch or the nated subnet point to null 0 interface and redistributed in the routing protocol used for DMVPN

for example ip route x.x.x.x y.y.y.y interface null 0 where x.x.x.x is the NATed network in your case 10.x.x.x

this neeed to be done per barnch site with NATing ( not sure why you doing NAting as long as its all private IPs ! )

anyway you can also have a look on the link bellow to a document i post on CSC before for DMVPN as backup

https://supportforums.cisco.com/docs/DOC-8356

good luck

if helpful Rate

[NemanjaPoprzen]

Finaly, problem solved.

Check this configuration on branch router (no change needed on central routers):

router eigrp 1

network a.a.a.a.a 0.0.0.0

network b.b.b.b 0.0.3.255

network c.c.c.c 0.0.3.255

redistribute static metric 1500 10 255 1 1500 route-map DISTR_STATIC_TO_EIGRP

eigrp stub connected summary redistributed

ip nat inside source static d.d.d.d e.e.e.e

ip nat inside source static f.f.f.f g.g.g.g

ip nat inside source static h.h.h.h i.i.i.i

ip route y.y.y.y 255.255.255.240 Null0 201

ip prefix-list DISTR_STATIC_TO_EIGRP seq 10 permit y.y.y.y.y/28

route-map DISTR_STATIC_TO_EIGRP permit 10

match ip address prefix-list DISTR_STATIC_TO_EIGRP

Thanks guys

[Marwan ALshawi]

glad to know that the statci route to null 0 on the braches fixed it

thanks for the rating