9300 Switch NAT on VLAN interface

[ira.miller]

Is is possible to set the ip nat outside and ip nat inside on VLAN interfaces on a Cisco 9300 switch? I've not done NAT on a switch so it's a little different for me.

I have a need to connect different networks with duplicate IPs. We can't change the IPs and need to be able to reach them via a natted ip address. The inside addresses are on a vlan that is trunked between switches.

Example:

VLAN2

ip address 10.10.10.254 255.255.255.0

ip address outside

vlan 3

ip address 192.168.1.254 255.255

ip address inside

nat inside source 10.10.10.10 192.168.1.10

(this is not the exact configuration, just from memory. I can get the exact config I am trying to make work.)

[paul driver]

Hello

TBH it would just be the same way in the SVI that it would on routed interfaces, the 9300 looks like it supports nat44 both static/dynamic domain pat.

Obviously depending on your requirements it wont be as basic than in the below example:

vlan2

ip address outside

vlan 3

ip address inside

access-list 100 permit ip 192.168.1.0 0.0.0.255 any

ip nat inside source list 100 interface vlan 2 

[omrra30]

I'm on a c9300 with IOS XE 17.05.01 and the Vlan Interfaces will not accept the term 'nat' and if you type 'ip address' the only acceptable input after that is an IP address.

So as aggravating, even infuriating as it is that this simple functionality isn't available, it appears MHM Cisco World is spot on. We'll have to burn 2 additional ports for no good reason to be able to NAT into a connected network with more than one usable IP in it.

My only solution currently is to configure one port as a routed port, and then plug it back into the switch on a vlan port and then back out to any additional connections in that network. 
Buyer beware! The c9300 is a crap choice as a WAN edge switch since you can't leverage a /29 handoff without sacrificing ports for no reason.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9300-series-switches/217419-configure-and-verify-nat-on-catalyst-900.html

I think NAT only support on router port not SVI.

[ira.miller]

Thanks for the input. I am still working on this issue. It appears the NAT is working but I have routing issues. 

This is part of a contract requirement to address duplicate IPs on connected networks without changing IP addresses to create unique IPs.

I will update when I get it working or have more questions.

[frederick.mercado]

what was your routing issue? I am having the same issues with NAT.