Policy Based Routing with NAT not working as expected

[Josh Mil]

The system consists of a switch with two VLANs for hosts, and a router with two WAN connections.

Switch:
Interface vlan10 - 192.168.1.1/24, with some hosts
Interface vlan20 - 192.168.2.1/24, with some hosts
interface g0/12 - 172.16.0.2/252, uplink to router
ip route 0.0.0.0 0.0.0.0 172.16.0.1

Router:
Interface g0/0/0 - 172.16.0.1/252, from switch, with PBR configured for distributing traffic to WAN1 and WAN2
Interface g0/0/1 - WAN1, DHCP client
Interface g0/0/2 - WAN2, DHCP client

Intended logic:
Hosts on 192.168.1.1/24 use WAN1 for internet access
Hosts on 192.168.2.1/24 use WAN2 for internet access
No load balancing, No failover. Two internet services are intended to be kept separate.

The problem is, when both WAN interfaces are up, none of hosts from vlan 10 and vlan 20 has internet access. If I shut down one WAN interface, the hosts in the vlan that is distributed by PBR to the other WAN interface are able to access internet. For example, if WAN2 is shut down, hosts on 192.168.0.1/24 can access internet.

Could someone please help me figure out the reason? Thank you.

 
*** 1xLAN and 2xWAN interfaces ***

interface g0/0/0
! receives traffic from LAN and distributes to two WAN interfaces
 ip address 172.16.0.1 255.255.255.252
 ip nat inside
 ip policy route-map rm_lan_to_wan

interface g0/0/1
! WAN 1
 ip nat outside

interface g0/0/2
! WAN 2
 ip nat outside

*** Policy Based Routing ***

route-map rm_lan_to_wan permit 10
 match ip address pbr_wan1
 set interface g0/0/1

route-map rm_lan_to_wan permit 20
 match ip address pbr_wan2
 set interface g0/0/2

ip access-list extended pbr_wan1
 permit ip 192.168.1.0 0.0.0.255 any

ip access-list extended pbr_wan2
 permit ip 192.168.2.0 0.0.0.255 any

*** NAT ***

ip access-list standard nat_wan1
 permit 192.168.1.0 0.0.0.255

ip access-list standard nat_wan2
 permit 192.168.2.0 0.0.0.255

ip nat inside source list nat_wan1 interface g0/0/1 overload
ip nat inside source list nat_wan2 interface g0/0/2 overload
 

[balaji.bandi]

You have route available as below :

ip route 0.0.0.0 0.0.0.0  ISP1 IP
ip route 0.0.0.0 0.0.0.0  ISP2 IP

check full configuration here  also SLA to failover if one of the ISP go down.

https://www.balajibandi.com/?p=1643

[Josh Mil]

Thank you. I particularly want to keep the two WAN services separate. Definitely don't want the two networks mixed up. VLAN10 should always use WAN1, VLAN20 should always use WAN2. As mentioned in the original post, no failover.

[Giuseppe Larosa]

Hello @Josh Mil ,

>> Definitely don't want the two networks mixed up. VLAN10 should always use WAN1, VLAN20 should always use WAN2. As mentioned in the original post, no failover.

I would use VRFs to have WAN1 and LAN1 in VRFA and WAN2 and LAN2 in VRFB, because you want each LAN to use only one WAN.

In each VRF configuration is very simple because there is only one LAN and one WAN.

Edit:

you would need two subinterfaces on the single LAN interface to use the two VRFs approach.

Hope to help

Giuseppe

[Josh Mil]

Thank you.

But the VLANs need to talk to each other within the same switch.

In terms of internet access, VLANs need to be isolated from each other.

[HaiCa]

Did you try to use set ip next-hop instead?

[Josh Mil]

Thank you.

Both WAN services are DHCP. I can't specify an IP address for the next hop.

[paul driver]

Hello

---

@Josh Mil wrote:

Thank you.

Both WAN services are DHCP. I can't specify an IP address for the next hop.

---

You should be able to, check the route table for candidate static routes  *

sh ip route static

[Josh Mil]

There is no gateway address listed in sh ip route static. Instead, it's just the interface name, such as "0.0.0.0/0 is directly connected, g0/0/1"

That actual IP address changes every time when the interface is disabled/enabled or the route is rebooted.

[paul driver]

Hello
As you are receiving dhcp wan ip allocation your site router will have dual dhcp candidate default routes with the same A/D distance (254)
I would say manually specify a primary interface with a lower administrative distance then just policy route towards the secondary wan interface, (here you can add some conditional tracking for wan resiliency if you wish- excluded at present)

Also specifying a PBR interface on a multi=-access interface may result in PBR/NAT not working, it would be preferable to set an ip next hop address ( you should be able find this in the routers route table for the default candidate routes  - ( show ip route static)

As for the NAT-
Your route-maps you need to add a match clause towards each wan interface , again no resiliency is shown here but you would require possibly some EEM scripting to clear and flush the nat translation tables to accomplish and also tweak your NAT acls to provide translation for ALL hosts if/when either wan interface fails ( again not shown here)

Example:
sh ip route static

int x/x
description WAN1
ip dhcp client default-router distance 1

int x/x
description WAN2
ip dhcp client default-router distance 2 *

no route-map rm_lan_to_wan permit 10
route-map rm_lan_to_wan permit 20
no set interface g0/0/2
set ip next-hop x.x.x.x

ip access-list standard nat_wan1
match interface gig0/1

ip access-list standard nat_wan2
match interface gig0/2

[Josh Mil]

Thank you.

But I think this is risky:
>>> manually specify a primary interface with a lower administrative distance then just policy route towards the secondary wan interface

For example, if I specify WAN1 as primary, and use PBR to direct Vlan20 traffic to WAN2, what would happen if WAN1 is down due to a technical failure or ISP outage? Hosts in Vlan10 will go to WAN2 as well. This will break the isolation.

[paul driver]

Hello

---

@Josh Mil wrote:

For example, if I specify WAN1 as primary, and use PBR to direct Vlan20 traffic to WAN2, what would happen if WAN1 is down due to a technical failure or ISP outage? Hosts in Vlan10 will go to WAN2 as well. This will break the isolation.

---

No it wont - as if you do not specify a nat policy towards wan2 for the hosts in vlan 10 they will not be able have external reachability, and even more so if you do NOT specify a primary interface then the rtr would simply try an EMCP between dual default paths with the same AD of 254

[Josh Mil]

Thank you for correcting me. Now I see. Without an explicitly defined NAT rule, Vlan10 won't go to WAN2. Thank you.

[Josh Mil]

I appreciate the alternative solutions provided in the above replies. I truly thank you for your help.

But my question is: Cisco published PBR and NAT as usable functions of their router products. My config code complies with Cisco's syntax. There is no error reported. Logic is simple and clear. Why does it not work?

An organisation has two WAN connections from two ISPs. Internet-bound traffic from LAN hosts are distributed to the two WAN connections based on the department that the host belongs to. Isn't it a very normal, legit and reasonable scenario? Why is it so difficult to implement such a simple requirement?

[paul driver]

Hello
FYI -based on what you have posted your configuration is incorrect- hence why it doesn't work. 
It isn't difficult to implement anything as you understand all the features that incorporates a working solution whatever you maybe working on  (including  dual WAN/NAT & policy based routing) 
But just obtaining the an example configuration but not having an understanding of how it works is the key.