tl;dr: I have 2911 with a single outside interface and its own external IP address on it. I have 3 VRFs one this router, each VRF has an ASA then a L3 switch. I have a /28 from my ISP. How can I NAT each VRF to it's own seperate external IP?
My boss might be asking the impossible but there must be a way to pull this off. I've taught myself quite a bit these last couple days but I've hit a snag. I have a lot of experience with ASA's and switches but not as much with routers.
We have a production, development, and testing environment that all have their own firewall on our edge. Behind them is a L3 switch that handles all the internal routing/switching. All three have the exact same VLAN and IP scheme.
Our new internet content filtering service needs GRE's built to their cloud. What the higher ups are thinking is that we should be able to put a router on the edge and tuck all three environments behind the same router.
What I've mocked up so far is a 2911 with a VRF for each environment and one more so they can share the connection out to the internet. I've got BGP working between them (that's how I got them the route out) and I can NAT overload the outside interface and get hosts from inside the VRF's out onto the internet using the IP of the outside interface.
My immediate problem is how can I NAT overload each VRF to it's own external IP? I have a /28 from the ISP to play with. I can't just translate an external IP to a firewall's outside IP and then run PAT at the firewall either because when I start building and trying to pump traffic through the GRE's the traffic needs to have it's original IP address.
I've been browsing the forum for three days now. I don't necessarily need someone to detail for me how to do this (though you're more than welcome to!). I at least need some guidance on what concept(s) to research to get me going.
Thanks!
Kyle
