ISSUE WITH NAT ON A STICK using Loopback

[JUANNN]

Hello,

I am doing both on CML and on hardware the following configuration:

The goal is to configure NAT on the NAT_ROUTER using only 1 physical interface (G1.10), which will be on the INSIDE.

I have tried it with 2 subinterfaces, one as inside and one as outside, and it worked.

However, the next step is to get it to work using only 1 subinterface. For this, I created a Loopback interface and set it as the OUTSIDE:

Since the traffic from the users (from HOST1 which is in vlan 10.0.0.0 /24, and HOST1 has an interface VLAN 10 emulating a host with IP address 10.0.0.2 /24) gets routed before NATed when it goes through G1.10, I configued PBR to match that traffic (as you can see in the G1.10 screenshot) and place it on the loopback interface, which is on the OUTSIDE (next hop set by PBR is in network directly connected to lo0, 10.0.1.0 /30), so that way it gets NATed before routed:

Once my traffic with source 10.0.0.2 is placed in the loopback 0 interface on the OUTSIDE, NAT takes place and applies the following:

The source of my traffic from HOST 1 now should be 192.168.1.3. The destination is (for example) 100.100.100.100 (INET_SERV). The NAT router then routes traffic using the default route pointing to CMTS:

which is successfully installed in the RIB (in case someone was doubting). Once the traffic gets to CMTS, the rest of the path to INET_SERV is fine.

On the way back to HOST1, traffic from CMTS coming from INET_SERV has a source of 100.100.100.100 and a destination of 192.168.1.3. It gets to G1.10, but again matches PBR and gets placed on the loopback 0 interface:

Once traffic gets placed to the loopback0 interface, again is NATed before routed,. Since traffic has now a source of 100.100.100.100 and destination of 192.168.1.3, it should match the following NAT rule:

and the destination IP address of traffic should be translated to 10.0.0.2, which is HOST1 IP address, and finally traffic should get routed back to HOST1.

However, I might be doing something wrong or misunderstanding NAT or PBR, because traffic from HOST1 to INET SERV is reaching INET SERV, but NAT is not translating traffic in the NAT router. On the packet captures that I have done in the link between CMTS and INET_SERV, I see the ICMP request with source 10.0.0.2 and destination 100.100.100.100, which means that traffic goes through NAT router without getting translated. Traffic the cannot make it back since INET_SERV does not have a route to 10.0.0.0 /24. I know I could configure NAT on CMTS or a route to 10.0.0.0 /24 on INET_SERV to solve this, but the goal is to solve it from the NAT router.

I have tried this on hardware (CISCO 3650 port switch as L2SW and C1121X routers) and software (CML2.7.2) and no success. I have been stuck with this countless hours for many days.

Anyone knows what could be wrong, or if I am misunderstanding anything?

Thanks, any help is appreciated,

Juan

[MHM Cisco World]

I think you config PBR under two interface and this wrong 

You need to config PBR to direct traffic to LO under inside subinterface only and retrun traffic since it will Un-NAT to LO it will automatically direct to LO not need PBR.

MHM

[JUANNN]

Hello,

Thanks for interest. I think you config PBR under two interface and this wrong. Maybe my screenshots were confusing: I only configured PBR on G1.10 (just one time) with the two entries on the ACL. I am sorry, I could not understand the second part: and retrun traffic since it will Un-NAT to LO it will automatically direct to LO not need PBR. Do you mean modify the ACL for PBR? 

Thanks

Juan

[MHM Cisco World]

Ok' sorry I was thinking it two PBR

And re check PBR you point traffic to wrong IP

LO ip is 10.0.1.1 and you use in pbr 10.0.1.2

MHM

[JUANNN]

Hello MHM,

Thanks again for interest. The reason I use 10.0.1.2 is because is I have to set a next hop that is not the router itself: the router sees that 10.0.1.2 is local to lo0 (since lo0 is 10.0.1.1 /30, sorry if I didn't mention /30

, so that way it routes traffic to lo0. I could also use set interface lo0, which I tried, and still didn't work. 

I tried what you said just to see if it works, but nothing. Any thoughts?

[MHM Cisco World]

Ok get it  use set interface LO instead of set next hop.

Also 

The NAT must from 10.0.0.0/24 to LO IP not to 192.168.1.0.

MHM

[JUANNN]

Hello MHM,

I get the NAT must from 10.0.0.0/24 to lo0 IP, for incoming traffic from Host1. I get the second part, becaue you are saying that NAT should translate destination from 192.168.1.3 to 10.0.0.2. However, since G1.10 in INSIDE, routing comes first, so it will see that to route a packet destined to 192.168.1.3 is via G1.10, and NAT will not be able to act. If I add the add-route keyword, is still will not work because the route will be 192.168.1.3 via 10.0.0.2. 

I will try what you said anyways. Also, why CMTS needs route for lo0? 

[MHM Cisco World]

Also check CMST have route for LO.

MHM

[JUANNN]

Hello MHM,

Thanks again for interest. The reason I use 10.0.1.2 is because is I have to set a next hop that is not the router itself: the router sees that 10.0.1.2 is local to lo0 (since lo0 is 10.0.1.1 /30, sorry if I didn't mention /30

, so that way it routes traffic to lo0. I could also use set interface lo0, which I tried, and still didn't work. 

I tried what you said just to see if it works, but nothing.

Any thoughts?

[MHM Cisco World]

From my view you can not NAT from subnet to other subnet and both subnet connect to same Interface g1.10.

My suggestion

What you can do remove secondary 192.16.81.0 from g1.10 and add this subnet to LO as primary or secondary and keep all config as it (except using set interface LO in PBR)

[JUANNN]

I am trying what you said, thanks for the suggestion. However, then I face the followimg problem: on CMTS, the IP address of the subinterface.10 is on 192.168.1.0 /29 subnet, and in NATrouter G1.10 it will end up being on 10.0.0.0 /24 subnet. 

So for return traffic from CMTS with a destination 192.168.1.3, there is an issue. It cannot go through G1.10 on NAT router. I tried using PBR to place return traffic on lo0, but nothing. 

I am using CML right now, but I might try your suggestion on hardware when I get access to it. 

[MHM Cisco World]

To correct answer you 

Please share last code you use.

MHM

[paul driver]

Hello @MHM Cisco World 

---

@MHM Cisco World wrote:

From my view you can not NAT from subnet to other subnet and both subnet connect to same Interface g1.10.

My suggestion

What you can do remove secondary 192.16.81.0 from g1.10 and add this subnet to LO as primary or secondary and keep all config as it (except using set interface LO in PBR)

---

it is possible - please review my post..

[avag2815]

I was reading a Cisco's manual about NAT on Stick configuration, inside-inside NAT and many discussions, but still not sure how to implement that in my case. The only disadvantage of using loop back addresses is that, like physical interfaces, they require a unique network  monkey type  address. This can be quite an overhead with classfull routing protocols like IGRP and RIP.You can create loop back rules from destination NAT rules to allow internal hosts to communicate with other internal hosts over the external IP address or the domain name. For example, create a destination NAT rule to translate incoming traffic to your servers and create a loop back rule.

[paul driver]

Hello
I would say looking at your OP the reason is possibly the way you are trying to hairpin.
As a test remove the subinterface and use the physical instead, switch the ip address on that interface around and use any ip on the loopback other than your active subnets and test again

Example NAT rtr

route-map PBR
set interface Loopback0

interface Loopback0
ip address 1.1.1.1 255.255.255.255
ip nat inside

interface GigabitEthernet1
ip address 10.0.0.1 255.255.255.0 secondary
ip address 192.168.1.2 255.255.255.0
no ip redirects
ip nat outside
ip policy route-map PBR

ip nat inside source list public interface GigabitEthernet1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 192.168.1.1

ip access-list extended public
deny ip 10.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255 (optional)
permit ip 10.0.0.0 0.0.0.255 any