Inside-Inside NAT On ISR4451?

[jmperlewitz]

I am trying to build some server infrastructure at my staging location which will be shipped to another store location.  We want to build the clusters with the store IP so that it build correctly and we do not have to re-IP the server cluster.

I built a vlan that uses the same store IP at my staging facility.  I need to NAT these store IPs to an IP block from my staging facility so that it can route to my corpnet and then come back to my staging facility rather than the store.  Is there a way to do NAT from inside to inside?

Store IP block: 10.10.10.0/28

Staging IP block: 192.168.1.0/28

I need to NAT from 10.10.10.0 to 192.168.1.0.  I need 1:1 NAT.  It needs to NAT over my VPN tunnel which is an inside zone.  I do not want to route over the internet since I am trying to hit my corpnet resources via the tunnel.

Any ideas?  Thanks

[Francesco Molino]

Hi

Can you share a quick drawing on how everything is connected together with this isr?
You should probably be able to do Nat but before sharing some configs i would prefer checking how the connection is done between your staging site and corporate office

[jmperlewitz]

As you can see, I am already advertising the 10.10.10.0/28 from my store.  I want to nat the 10.10.10.0/28 IP space at my staging facility to a local staging subnet 192.168.1.0/28 so it can route to my corpnet resources and return back to my staging facility where it will have the static NAT mapping and route back to the 10.10.10.0/28 IP at my staging facility after it returns from corpnet. 

[Francesco Molino]

Your staging 10.10.10.0/28 access the Corp network through a tunnel interface going to ASR. But you've written bgp advertise your local 192.168.1.0/28 over internet?
Is this subnet 192.168.1.0/28 existing on your ISR? This is what's not clear.
If not existing, you can do nat inside isr interface facing your switch and nat outside on your tunnel interface.

You can simply configure ip nat enable on both interfaces and then user the command:

Ip nat source static network 10.10.10.0 192.168.1.0 28

Ip nat source static network 192.168.1.0 10.10.10.0 28

[jmperlewitz]

Hi Francesco,

Actually. BGP is advertising the 192.168.1.0 to the ASR not the internet.  Sorry for the misrepresentation in the drawing.  I tried putting ip nat outside on the Tu10 interface but it breaks the rest of the network at my staging site when I do this.

[Francesco Molino]

I'm sorry but still not clear enough. The subnet 192.x is located where? Is it a local subnet in your lab like 10.x?
Can you use another subnet?

When you say it breaks everything else, can you share the config you've tried?

[paul driver]

Hello

---

@jmperlewitz wrote:

  I need to NAT these store IPs to an IP block from my staging facility so that it can route to my corpnet and then come back to my staging facility rather than the store.  Is there a way to do NAT from inside to inside?

Store IP block: 10.10.10.0/28

Staging IP block: 192.168.1.0/28

I need to NAT from 10.10.10.0 to 192.168.1.0.  I need 1:1 NAT.  It needs to NAT over my VPN tunnel which is an inside zone.  I do not want to route over the internet since I am trying to hit my corpnet resources via the tunnel. 

---

1:1 nat is indeed applicable however you dont mention what subnet is being used between these to sites so as to be able to nat between them - 

Example for 1:1 nat

Store IP block: 10.10.10.0/28

ip access-list 10 permit 10.10.10.0 0.0.0.7

ip nat pool Store-IP x.x.x.1 x.x.x.6  prefix-length 28 type match-host

ip nat inside source list 10 pool Store-IP

Staging IP block: 192.168.1.0/28

ip access-list 10 permit 192.168.1.0 0.0.0.7

ip nat pool Staging-IP x.x.x.1 x.x.x.6  prefix-length 28 type match-host

ip nat inside source list 10 pool Staging-IP

[jmperlewitz]

Hi Paul:

1:1 nat is indeed applicable however you dont mention what subnet is being used between these to sites so as to be able to nat between them 

I'm not sure what you mean here.  Per my drawing, I have a 10.10.10.0/28 subnet being advertised from my store.  I need to use this same subnet at my staging site so I can stage my server cluster using the store IPs.

I want to nat from 10.10.10.0/28 to 192.168.1.0/28 (which is IP space at my staging facility).  I need to NAT to my Staging facility IP space so that I can route correctly from the staging facility to my Corpnet.

It routes over Tu10, which is configured for NAT Inside

I hope this is more clear.  Thanks

[paul driver]

Hello

Unfortunately no it isn't clear , well for me at least.

Your nat inside local addressing would be the two /28 subnets of storage and staging blocks correct?

Your OP requests 1:1 nat -  Meaning any nat outside global address is mapped to its relevant the inside local address.

So to nat between these two areas what is connecting them? - You need some physical outside path / interface to nat towards from either area however what I can see is both these subnets reside on the single ASR rtr locally

[jmperlewitz]

I want my 10.x inside local to translate to the 192.x outside global and route over my VPN to the ASR.  When the packet comes into the ASR, it needs to have a source IP of 192.x rather than 10.x or else it will route back to the Store instead of the staging facility.

The problem I am having is the only outside NAT interface I have setup is the gi0/0/2 which goes to the internet.  I do not want to go to the internet.  I need to go to VPN but I cant make my VPN interface NAT Outside.  Hence why I cant really get traditional NAT to work.

I am trying to think of a clever solution to get it to work but it looks like that will not be possible.