L2NAT within Same switch

[Himanshu_Dwivedi]

Hello,

I need to deal with the situation with L2NAT on the same switch. Where 2 PC are on same L2 Switch with different range of IP Address and I want PCB to be seen as 10.0.0.1 to PCA, can anyone let me know, is it possible to do that, I believe no, but wants feedback on this

[Georg Pauwen]

Hello,

interesting question. What happens if you create an instance and use both IP addresses, one as inside and the other as outside ? Do you get an error message ?

[Himanshu_Dwivedi]

Hello,

I tried to do below config,

l2nat instance TEST
inside from host 192.168.1.1 to 10.0.0.1
outside from host 10.0.0.2 to 192.168.1.2

interface G1/1
l2nat TEST

int G1/1 is connected to PCB

But the I can see the packets are being discarded.

[paul driver]

Hello
Those two hosts already have non duplicate ip addressing so not sure why you want to use L2NAT.
Also as they in differing subnets connected to the IE switch so are these two hosts able to communicate with each other at present, then if so then what is performing the L3 function for that communication to happen? - is it the IE switch even though you state its an L2 switch or do you have an upstream L3 switch, 

Can you elaborate on the topology a little more please , as simple question would be why not just change host PC B to 10.0.0,1 or are you unable to do so?

[Himanshu_Dwivedi]

Paul, thanks for your suggestion.

Presently customer don't have L3 switch and IE4010 is acting as L2 switch. Customer want to check the functionality of L2 NAT within a switch.

As said by you that both the PC are not same subnet and IP, now what will happen if both the PC have same IP address, then it would work or not?

[paul driver]

Hello @Himanshu_Dwivedi 
First question that comes to mind is do you need to have those hosts on the IE switch(s) requiring external reachability, and/or do you have multiple IE host/ switches that are using the same ip subnet range internally that need to communicate with each other and an external network, If you do not have this then L2NAT isn't required

[Himanshu_Dwivedi]

There is only single IE which do not have a connection to L3 switch and do not required external reachability. However in future it will have connection to L3 SWITCH. But as for now we need to take a scenario suppose if we have 2 end device with same IP address and both of them want to communicate with each other, is that possible through L2NAT.

[paul driver]

Hello
Then yes it is, the l3 switch of the LAN can become the zone switch between the two IE switch that have hosts using the same ip address.

So this routed L2NAT will be able to communication between the two internal hosts but also external hosts if required, plus the add benefit of negating unwarranted L2 broadcasted traffic as now you have a routed connection between the zone and IE switch(s)

[Himanshu_Dwivedi]

Addition to this I check on cisco website and as per screenshot it should work. But same thing is configured but didn't worked. I am not sure whether the LC and PC in this screenshot is directly connected to a single switch or there is another intermediate switch on which LC is connected.

[MHM Cisco World]

Both PC not in same Subnet!! Sure that case otherwise why we use l2nat.

Can you give me time to analysis issue reply you tonight or tomorrow.

Thanks 

MHM

[MHM Cisco World]

L2nat instance name

Instance-id x

Permit all 

Fixup all

Outside  from host xxxxx to xxxxx gateway 

Inside from host xxxx to xxxxx 

Check this way 

MHM

[Himanshu_Dwivedi]

Let me try, but have only single switch which is a L2 will that work?

I can try on packet tracer but unfortunately there is no gateway command available 

[MHM Cisco World]

Please consider @paul driver note about permit all

Thanks 

MHM

[paul driver]

Hello @MHM Cisco World 
FYI  - when you do L2 forwarding for L2 NAT then obviously its not routed access, so you need to be careful with the broadcast and not to allow the "permit all" (default) otherwise you can bring down you entire L2 network

So for L2nat to work at at L2 forwarding perspective you would still need a device that has access to inside/outside network thats connected to the IE/Zone switch because of the following:.

"Outside  from host xxxxx to xxxxx gateway"  =  this is the external GW
"Outside  from host xxxxx to xxxxx gateway"  = this is the internal GW

"Inside from host xxxx to xxxxx" =  this is the internal host ip 
"Inside from host xxxx to xxxxx" =  this is the external translated host ip

[Himanshu_Dwivedi]

As I understood from this, that we need some connection to IE/Zone switch, if we dont have the connection It will not work within the single switch?