Accepted Solutions
I think i've come up with a solution for you. We'll have to use VRF's if you want overlapping addresses. I'll try to demonstrate with this example here:
Here I have switch 1 where my clients are connected - I am only showing a PC who is client 1 with an IP of 11.11.11.100.
It has a default gateway of the VRF which is 11.11.11.1 on R1.
I am doing 'router on a stick' - this involves creating sub-interfaces on the router with the correct encapsulation and a trunk being configured on SW1.
Wherever my clients are connected I just have to put them in the right VLAN.
lets say client is connected to the SW1 on fa1/11.
The configuration would be:
interface fa1/11
switchport
switchport mode access
switchport access vlan 1
just a simple access port. Please NOTE: I have not configured any addresses on the switch! its only doing my Layer 2. I'll leave all the hard work for the router to do - router's are built to route :-)
Here is the configuration of SW1:
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
description UPLINK TO R1
switchport trunk allowed vlan 1-5,1002-1005
switchport mode trunk
duplex full
speed 100
!
interface FastEthernet1/1
!
interface FastEthernet1/2
!
interface FastEthernet1/3
!
interface FastEthernet1/4
!
interface FastEthernet1/5
!
interface FastEthernet1/6
!
interface FastEthernet1/7
!
interface FastEthernet1/8
!
interface FastEthernet1/9
!
interface FastEthernet1/10
!
interface FastEthernet1/11
description CLIENT-1
switchport
switchport mode access
switchport access vlan 1
!
interface FastEthernet1/12
description CLIENT-2
switchport
switchport mode access
switchport access vlan 2
!
interface FastEthernet1/13
description CLIENT-3
switchport
switchport mode access
switchport access vlan 3
!
interface FastEthernet1/14
description CLIENT-4
switchport
switchport mode access
switchport access vlan 4
!
interface FastEthernet1/15
description CLIENT-5
switchport
switchport mode access
switchport access vlan 5
SW1#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/11
2 VLAN0002 active Fa1/12
3 VLAN0003 active Fa1/13
4 VLAN0004 active Fa1/14
5 VLAN0005 active Fa1/15
Just a simple config with my layer 2 in place.
No routes needed, no SVI interfaces needed.
Lets go over to R1 where the VRF magic happens.
R1#show run
Building configuration...
Current configuration : 2387 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
ip vrf client-1
rd 1:11
!
ip vrf client-2
rd 2:22
!
ip vrf client-3
rd 3:33
!
ip vrf client-4
rd 4:44
!
ip vrf client-5
rd 5:55
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
interface FastEthernet0/0
ip address 125.212.50.54 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
speed 100
full-duplex
!
interface FastEthernet0/1.11
encapsulation dot1Q 1 native
ip vrf forwarding client-1
ip address 11.11.11.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.22
encapsulation dot1Q 2
ip vrf forwarding client-2
ip address 22.22.22.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.33
encapsulation dot1Q 3
ip vrf forwarding client-3
ip address 33.33.33.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.44
encapsulation dot1Q 4
ip vrf forwarding client-4
ip address 44.44.44.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.55
encapsulation dot1Q 5
ip vrf forwarding client-5
ip address 55.55.55.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 125.212.50.53
ip route vrf client-1 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-2 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-3 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-4 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-5 0.0.0.0 0.0.0.0 125.212.50.53 global
!
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-1 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-2 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-3 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-4 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-5 overload
!
ip access-list extended MY_NAT
permit ip any any
This configuration will allow you to have a default route to the global routing table and be allowed to route out towards the internet. It's important to remember NAT. And I have included the relevant configuration for NAT for all of your VRF's
GLOBAL ROUTING TABLE:
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 125.212.50.53 to network 0.0.0.0
125.0.0.0/30 is subnetted, 1 subnets
C 125.212.50.52 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 125.212.50.53
VRF ROUTING TABLE FOR CLIENT-1
R1#show ip route vrf client-1
Routing Table: client-1
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 125.212.50.53 to network 0.0.0.0
11.0.0.0/24 is subnetted, 1 subnets
C 11.11.11.0 is directly connected, FastEthernet0/1.11
S* 0.0.0.0/0 [1/0] via 125.212.50.53
As you can see the default route has been introduced to the routing table - I want to try and ping outbound from this VRF just to see if I can get to that 100.0.0.1 address out in the internet....
R1#ping vrf client-1 100.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/24 ms
R1#
*Mar 1 00:43:18.795: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [15]
*Mar 1 00:43:18.811: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [15]
*Mar 1 00:43:18.815: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [16]
*Mar 1 00:43:18.831: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [16]
*Mar 1 00:43:18.831: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [17]
*Mar 1 00:43:18.851: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [17]
*Mar 1 00:43:18.855: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [18]
*Mar 1 00:43:18.875: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [18]
*Mar 1 00:43:18.879: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [19]
*Mar 1 00:43:18.891: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [19]
As you can see - the ping was successful and NAT took place and correctly translated the VRF's address. Lets look at it from the INTERNET router's perspective. This time I'll try to ping the 10.0.0.1 address from the client.
INTERNET#
*Mar 1 01:32:05.239: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.239: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
*Mar 1 01:32:05.243: IP: tableid=0, s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), routed via FIB
*Mar 1 01:32:05.243: IP: s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), len 100, sending
*Mar 1 01:32:05.263: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.263: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
*Mar 1 01:32:05.263: IP: tableid=0, s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), routed via FIB
*Mar 1 01:32:05.267: IP: s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), len 100, sending
*Mar 1 01:32:05.307: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.307: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
So INTERNET router see's the NAT traffic from 125.212.50.54 which is good, because it will reply back to our WAN address - we are able to ping the 10.0.0.1 address successfully.
When I try to ping from client 1 to client 2 - I have no route to get to it and it should fail, so I'll test this:
R1#ping vrf client-1 22.22.22.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.22.22.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1#
*Mar 1 00:58:17.819: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [25]
*Mar 1 00:58:17.839: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [17]
*Mar 1 00:58:17.843: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [26]
*Mar 1 00:58:19.839: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [27]
*Mar 1 00:58:19.855: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [18]
*Mar 1 00:58:19.855: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [28]
*Mar 1 00:58:21.855: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [29]
*Mar 1 00:58:21.887: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [19]
It tries to use the default route - hence why we see the NAT attempts, but will not be able to get there so it fails!
So in summary
- your clients should have the default gateway of the VRF address
- you need to have a trunk from your switch to the router instead of a routed interface or access port
- make sure that the SVI's for these client vlans do not exist on the switch (for the client vlans, the switch should only be layer 2)!
- simple access port required for clients - just like your config too
- ensure default route exist within the routing table
- create the routes for your vrf's pointing to the global routing table
- create the acl for NAT and the NAT statements to correctly NAT outbound traffic
Quite a bit to take in - if you have any questions about this, i'll be happy to help!
Please rate useful posts and remember to mark any solved questions as answered. Thank you.
Message was edited by: Bilal Nawaz
I think i've come up with a solution for you. We'll have to use VRF's if you want overlapping addresses. I'll try to demonstrate with this example here:
Here I have switch 1 where my clients are connected - I am only showing a PC who is client 1 with an IP of 11.11.11.100.
It has a default gateway of the VRF which is 11.11.11.1 on R1.
I am doing 'router on a stick' - this involves creating sub-interfaces on the router with the correct encapsulation and a trunk being configured on SW1.
Wherever my clients are connected I just have to put them in the right VLAN.
lets say client is connected to the SW1 on fa1/11.
The configuration would be:
interface fa1/11
switchport
switchport mode access
switchport access vlan 1
just a simple access port. Please NOTE: I have not configured any addresses on the switch! its only doing my Layer 2. I'll leave all the hard work for the router to do - router's are built to route :-)
Here is the configuration of SW1:
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
description UPLINK TO R1
switchport trunk allowed vlan 1-5,1002-1005
switchport mode trunk
duplex full
speed 100
!
interface FastEthernet1/1
!
interface FastEthernet1/2
!
interface FastEthernet1/3
!
interface FastEthernet1/4
!
interface FastEthernet1/5
!
interface FastEthernet1/6
!
interface FastEthernet1/7
!
interface FastEthernet1/8
!
interface FastEthernet1/9
!
interface FastEthernet1/10
!
interface FastEthernet1/11
description CLIENT-1
switchport
switchport mode access
switchport access vlan 1
!
interface FastEthernet1/12
description CLIENT-2
switchport
switchport mode access
switchport access vlan 2
!
interface FastEthernet1/13
description CLIENT-3
switchport
switchport mode access
switchport access vlan 3
!
interface FastEthernet1/14
description CLIENT-4
switchport
switchport mode access
switchport access vlan 4
!
interface FastEthernet1/15
description CLIENT-5
switchport
switchport mode access
switchport access vlan 5
SW1#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/11
2 VLAN0002 active Fa1/12
3 VLAN0003 active Fa1/13
4 VLAN0004 active Fa1/14
5 VLAN0005 active Fa1/15
Just a simple config with my layer 2 in place.
No routes needed, no SVI interfaces needed.
Lets go over to R1 where the VRF magic happens.
R1#show run
Building configuration...
Current configuration : 2387 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
ip vrf client-1
rd 1:11
!
ip vrf client-2
rd 2:22
!
ip vrf client-3
rd 3:33
!
ip vrf client-4
rd 4:44
!
ip vrf client-5
rd 5:55
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
interface FastEthernet0/0
ip address 125.212.50.54 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
speed 100
full-duplex
!
interface FastEthernet0/1.11
encapsulation dot1Q 1 native
ip vrf forwarding client-1
ip address 11.11.11.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.22
encapsulation dot1Q 2
ip vrf forwarding client-2
ip address 22.22.22.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.33
encapsulation dot1Q 3
ip vrf forwarding client-3
ip address 33.33.33.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.44
encapsulation dot1Q 4
ip vrf forwarding client-4
ip address 44.44.44.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet0/1.55
encapsulation dot1Q 5
ip vrf forwarding client-5
ip address 55.55.55.1 255.255.255.0
ip nat inside
ip virtual-reassembly
rate-limit input 10000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 10000000 5000 5000 conform-action transmit exceed-action drop
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 125.212.50.53
ip route vrf client-1 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-2 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-3 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-4 0.0.0.0 0.0.0.0 125.212.50.53 global
ip route vrf client-5 0.0.0.0 0.0.0.0 125.212.50.53 global
!
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-1 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-2 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-3 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-4 overload
ip nat inside source list MY_NAT interface FastEthernet0/0 vrf client-5 overload
!
ip access-list extended MY_NAT
permit ip any any
This configuration will allow you to have a default route to the global routing table and be allowed to route out towards the internet. It's important to remember NAT. And I have included the relevant configuration for NAT for all of your VRF's
GLOBAL ROUTING TABLE:
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 125.212.50.53 to network 0.0.0.0
125.0.0.0/30 is subnetted, 1 subnets
C 125.212.50.52 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 125.212.50.53
VRF ROUTING TABLE FOR CLIENT-1
R1#show ip route vrf client-1
Routing Table: client-1
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 125.212.50.53 to network 0.0.0.0
11.0.0.0/24 is subnetted, 1 subnets
C 11.11.11.0 is directly connected, FastEthernet0/1.11
S* 0.0.0.0/0 [1/0] via 125.212.50.53
As you can see the default route has been introduced to the routing table - I want to try and ping outbound from this VRF just to see if I can get to that 100.0.0.1 address out in the internet....
R1#ping vrf client-1 100.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/24 ms
R1#
*Mar 1 00:43:18.795: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [15]
*Mar 1 00:43:18.811: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [15]
*Mar 1 00:43:18.815: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [16]
*Mar 1 00:43:18.831: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [16]
*Mar 1 00:43:18.831: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [17]
*Mar 1 00:43:18.851: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [17]
*Mar 1 00:43:18.855: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [18]
*Mar 1 00:43:18.875: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [18]
*Mar 1 00:43:18.879: NAT: s=11.11.11.1->125.212.50.54, d=100.0.0.1 [19]
*Mar 1 00:43:18.891: NAT*: s=100.0.0.1, d=125.212.50.54->11.11.11.1 [19]
As you can see - the ping was successful and NAT took place and correctly translated the VRF's address. Lets look at it from the INTERNET router's perspective. This time I'll try to ping the 10.0.0.1 address from the client.
INTERNET#
*Mar 1 01:32:05.239: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.239: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
*Mar 1 01:32:05.243: IP: tableid=0, s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), routed via FIB
*Mar 1 01:32:05.243: IP: s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), len 100, sending
*Mar 1 01:32:05.263: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.263: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
*Mar 1 01:32:05.263: IP: tableid=0, s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), routed via FIB
*Mar 1 01:32:05.267: IP: s=10.0.0.1 (local), d=125.212.50.54 (FastEthernet0/0), len 100, sending
*Mar 1 01:32:05.307: IP: tableid=0, s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1 (Loopback1), routed via RIB
*Mar 1 01:32:05.307: IP: s=125.212.50.54 (FastEthernet0/0), d=10.0.0.1, len 100, rcvd 4
So INTERNET router see's the NAT traffic from 125.212.50.54 which is good, because it will reply back to our WAN address - we are able to ping the 10.0.0.1 address successfully.
When I try to ping from client 1 to client 2 - I have no route to get to it and it should fail, so I'll test this:
R1#ping vrf client-1 22.22.22.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.22.22.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1#
*Mar 1 00:58:17.819: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [25]
*Mar 1 00:58:17.839: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [17]
*Mar 1 00:58:17.843: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [26]
*Mar 1 00:58:19.839: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [27]
*Mar 1 00:58:19.855: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [18]
*Mar 1 00:58:19.855: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [28]
*Mar 1 00:58:21.855: NAT: s=11.11.11.1->125.212.50.54, d=22.22.22.1 [29]
*Mar 1 00:58:21.887: NAT: s=125.212.50.53, d=125.212.50.54->11.11.11.1 [19]
It tries to use the default route - hence why we see the NAT attempts, but will not be able to get there so it fails!
So in summary
- your clients should have the default gateway of the VRF address
- you need to have a trunk from your switch to the router instead of a routed interface or access port
- make sure that the SVI's for these client vlans do not exist on the switch (for the client vlans, the switch should only be layer 2)!
- simple access port required for clients - just like your config too
- ensure default route exist within the routing table
- create the routes for your vrf's pointing to the global routing table
- create the acl for NAT and the NAT statements to correctly NAT outbound traffic
Quite a bit to take in - if you have any questions about this, i'll be happy to help!
Please rate useful posts and remember to mark any solved questions as answered. Thank you.
Message was edited by: Bilal Nawaz
