Basically you either need to -
1) use NAT as you say for internet traffic. However depending on where you do the NAT you may also need additional config ie. -
a) you NAT at the remote site but then you still need to be able to distinguish the return traffic so you would need to use an IP or pool at each remote site and then have specific routes in the DC pointing to the Carrier-2 router
or
b) NAT overload on the Carrier-2 router to the inside interface of tha router so traffic is automatically sent back to the right router.
or
c) use a NAT pool on Carrier-2 for all the remote sites
the issues with b), and this can also affect c) is that IOS NAT does not NAT overload from outside to inside but it does from inside to outside. So if there is no NAT being done on that router you could make the inside interface the one connecting to the MPLS network and the outside interface the one connecting to the internal DC.
The advantage of b) and c) if you can do them is you only need configuration on the Carrier-2 router, no need to configure other routers or add routes within the DC.
The advantage of a) is you are not going to possibly run out of NAT translations and you spread the load beween all routers.
The other possiblity is to use PBR although it's not clear what network devices you have within the DC eg L3 switches etc.
With PBR you could in your acl deny any return traffic from internal DC subnets so it is routed normally and then permit everything else ie. internet traffic and send this to the Carrier-2 router.
The advantage of this is no NAT which can break certain things. Again it also means just configuration within the DC and nothing to do in the remote sites.
The disdvantages are PBR requires a certain feature set on certain switches and using deny statements in your acl can have adverse effects on the CPU. There are ways round it but you are in effect doing PBR on all traffic **
** If your internet connection is via a dedicated vlan eg. your firewalls are connected to your L3 switches on their own vlan then actually your acl becomes very simple because you do not have to account for non internet traffic eg. you would simply apply the PBR to the core switch SVIs that connect to your firewalls so the only actual traffic coming from the firewalls would be internet traffic and you simply match all traffic in your acl and set the next hop to be the Carrier-2 router.
Obviously i have made certain assumptions about your DC topology so if it is different or i haven't explained things very well then please come back with any further queries.
Jon
