[c-nsp] NAT out via loopback

[Jeff Behl]

i've got two 3560s, each with a privately addressed point-to-point link
to a 2851 (a trunked gig interface for each) and both connected to an ISP:


ISP---3560----p2p-----
                               2851
ISP---3560----p2p-----

The 3560s are connected to the ISP and have a public /25 routed to them
via p2p links.  They also have a number of private networks that contain
numerous hosts that they act as the gateway for (HSRP).  The 3560s
advertise a default route via ospf which is picked up by the 2851. They
also have a static default pointing to the ISP.

The 2851 has a couple public /32 addresses on loopbacks which are
advertised via ospf and picked up by the 3560s (i've split the /25 into
a few different blocks).   One of them acts as a static IPSEC/GRE VPN
tunnel endpoint, and I'd like the other to be an external NAT
interface.  The reason for this setup was to be able to maintain the VPN
link during the loss of one of the switches.  To this end everything is
working as expected, at least in terms of the VPN tunnel.

But now the trickier part...I'd like some of the hosts on the private
networks for which the 3560s are doing the routing to be able to get to
the internet via NAT.  As the 3560s don't do NAT, it has to be the 2851
that does it.  I'm looking for suggestions on the most elegant solution
for doing this??  Basically, one of the loopbacks on the 2851 would be
the outgoing IP address for NAT translations. Though I've not used VRFs
before, I'm getting inklings they could be used in a scenario such as
this?  The other solution seems to be some sort of policy based
routing.  I've used policy based routing in the past to direct traffic
that needs to be NATd from a switch to a router but it was as little
simpler in that the router's outgoing NAT address was just a normal
sub-interface and not a loopback. 

Thanks for any help.
jeff