static nat without WAN IP but with interface (VRF)

[mario.jost]

I want to configure a static nat entry on an ISR1k router. If i configure this: the nat works as it should. I can connnect from the WAN side to the client wihtout issues.

ip nat inside source static tcp 10.0.0.21 80 14.40.14.38 80 vrf DSL extendable

But this forces me to hard-configure the WAN ip address to the nat config. What if i have a dynamically changing IP address? If i use following command:

ip nat inside source static tcp 10.0.0.21 80 interface dialer1 80

This would be dynamic in my understanding, but the NAT does not work. Im guessing this is because i do not provide a VRF in this command. IOS does not let me choose a VRF if I use the interface. My thought process was: It doesnt need VRF information, because the interface does belong to a VRF, so it will automagically just take this VRF. But as it seems, it does not. Can anyone help out in setting a NAT configuration that dynamically takes the IP of an interface within a VRF?

[Georg Pauwen]

Hello,

I wonder if something like the below works:

ip nat inside source list HOST_1 interface Dialer1 vrf DSL overload
!
ip access-list extended HOST_1
permit tcp host 10.0.0.21 any eq 80

[mario.jost]

I tested it and it doest not work. This is, just a configuration that allows the client from the LAN to surf to the WAN but not the other way around.

[MHM Cisco World]

ok but before NAT there is routing do you config in both case the routing with VRF aware ?
I check the command ref. 

for global address only  

[mario.jost]

There is no route-leaking configured. So there is no way for traffic to traverse from the global VRF into the VRF DSL at this point. So this seems to be the reason why it does not work. Question: is there another way to configure NAT in a VRF using an interface wihout route-leaking?

[MHM Cisco World]

this AS I KNOW 
how we can solve this ??
first VRF is local in router so
we can try below
LAN -VRF X 
config ip route VRF X ...........interface global 
LAN - WAN using interface for NAT. 

I will make check and if I get solution I will update you.

[mario.jost]

As i wrote, im looking for a solution that does not involve routing in between VRFs. All i want is just to have a NAT between 2 interfaces that belong to the same VRF, so no inter-VRF routing needed. I would like to have the NAT dynamically use the IP of the WAN interface. This is possible on the way outside, so why isnt it possible the other way... basically, im looking for a command like:

ip nat inside source static tcp 10.0.0.21 80 interface dialer1 80 vrf DSL extendable

Im am now looking into VASI NAT, maybe this is the solution.

[MHM Cisco World]

friend I return to home make lab 
we can override the vrf in NAT by 
we config interface 
ip vrf forward <VRF>

this make interface already in VRF and not need to add keyword in NAT anymore. 
but you must notice that NAT interface INSIDE and OUTSIDE must be in same VRF. 

[mario.jost]

i just had a closer look onto VASI NAT and this does not seem to provide a solution for this problem. To the proposal of MHM Cisco World: The interfaces are both already assigned to a VRF, so i dont think your lab will lead to anywhere. My guess is, that there is no solution to this and cisco has to catch up to the competitors in this regard.

[MHM Cisco World]

Hi friend, keep cool first
I return to my lab and I see something wrong, 
I config the NAT as shown below 
from R2 I ping 100.0.0.1 (which will nat to 10.0.0.10 "R3")
and use wireshark and capture the traffic it normal
but 
when I try ping from R3 toward R2..
so that meaning you are right and there must something done to make traffic flow both direction. 
just want to update you 
and one more thing, your case both INSIDE and OUTSIDE same VRF ?

[mario.jost]

Same VRF. Quote:

---

@mario.jost wrote:

All i want is just to have a NAT between 2 interfaces that belong to the same VRF.

---

[MHM Cisco World]

I will do all my best to find answer, I will update you tonight. 

[paul driver]

Hello
Its because the nat statement isn’t in the nat vrf table it is just pointing to a vrf enabled interface hence no translation will occur inside the vrf table.

[mario.jost]

OK, so you point out why it is not working. Can you point me into the right direction on how i could get this to work? NVI NAT is not supported on IOS-XE anymore.

[mario.jost]

I just found out that this worked in IOS, but does not anymore in IOS-XE. I created a new post since this one has alot of answers, noone is going to look at this anymore.

https://community.cisco.com/t5/routing/ios-xe-static-nat-in-vrf-with-wan-interface/td-p/4699070