VTI with NAT on loopback

[TRENT WAITE]

I run into scenarios where remote sites will have either subnet or host address in use that is already in use at a different project. This has been problematic especially when using ASA's for IPSEC tunneling using ACLs. I do have a couple of test tunnels using DMVPN and was looking to see if I could use a loopback interface & NAT to avoid situation where a remote device would be using the same address as another site. Loopback, NAT, VTI

As shown in the picture below, what I wanted to do was access Remote Server at 192.168.1.2 from Local Server using 10.1.1.x address. A static NAT entry "ip nat inside source static 192.168.1.2 10.1.1.2" did not work, nor did port forwardLoopback, NAT, VTI "ip nat inside source static tcp 192.168.1.2 502 interface loopback1 502"

I have the below scenario working able to access the Remote Server & Loopback1 with both subnets advertised to the hub. What I do not know is if I try to use the NAT address whether the loopback even forwards it. A lot of the devices we work with tend to be configured with default 192.168.1.x subnet and it is often the case where the remote device can not get a change of subnet without an extensive infrastructure change. To date we have used a second device to do the NAT, I would just like to know can this be done on a single router connected to the remote device?

[Georg Pauwen]

Hello,

just to be sure, on which interface is IP address 10.1.1.2 configured ?

[TRENT WAITE]

Sorry that was a typo, I meant to write "ip nat inside source static 192.168.1.2 10.1.1.1" 

[Georg Pauwen · Accepted solution]

Hello,

what if you NAT the traffic going through the DMVPN to the tunnel ?

On your spoke, this is what I am thinking about:

ip nat inside source route-map TUNNEL interface Tunnel1 overload
ip nat inside source route-map INTERNET interface GigabitEthernet0 overload
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
route-map TUNNEL permit 10
match ip address 101
match interface Tunnel1
!
route-map INTERNET permit 10
match ip address 101
match interface GigabitEthernet0

[Georg Pauwen]

Hello,

if you need a static NAT entry, use the IP address of the tunnel...

[TRENT WAITE]

Georg, 

Thank you, that did work doing NAT on the tunnel interface. I have tested and can connect to the test device using tunnel interface.