[c-nsp] NAT out via loopback

[Oliver Eyre]

Hi Jeff,

Not sure if this is the best solution, but at my office we have a 
primary link and a backup link and we NAT out of the loopback so our 
telnet and SSH sessions don't crash on us if we ever switch links.

Here are the relevant bits of config (on 1811)

interface Loopback0
ip nat outside

interface FastEthernet0
description Primary link
ip nat outside

interface FastEthernet1
description Backup link
ip nat outside

interface Vlan100
description Internal Network
ip nat inside

ip nat inside source list 11 interface Loopback0 overload

Hope this helps.

Oliver

Jeff Behl wrote:
> i've got two 3560s, each with a privately addressed point-to-point link
> to a 2851 (a trunked gig interface for each) and both connected to an ISP:
>
>
> ISP---3560----p2p-----
>                                2851
> ISP---3560----p2p-----
>
> The 3560s are connected to the ISP and have a public /25 routed to them
> via p2p links.  They also have a number of private networks that contain
> numerous hosts that they act as the gateway for (HSRP).  The 3560s
> advertise a default route via ospf which is picked up by the 2851. They
> also have a static default pointing to the ISP.
>
> The 2851 has a couple public /32 addresses on loopbacks which are
> advertised via ospf and picked up by the 3560s (i've split the /25 into
> a few different blocks).   One of them acts as a static IPSEC/GRE VPN
> tunnel endpoint, and I'd like the other to be an external NAT
> interface.  The reason for this setup was to be able to maintain the VPN
> link during the loss of one of the switches.  To this end everything is
> working as expected, at least in terms of the VPN tunnel.
>
> But now the trickier part...I'd like some of the hosts on the private
> networks for which the 3560s are doing the routing to be able to get to
> the internet via NAT.  As the 3560s don't do NAT, it has to be the 2851
> that does it.  I'm looking for suggestions on the most elegant solution
> for doing this??  Basically, one of the loopbacks on the 2851 would be
> the outgoing IP address for NAT translations. Though I've not used VRFs
> before, I'm getting inklings they could be used in a scenario such as
> this?  The other solution seems to be some sort of policy based
> routing.  I've used policy based routing in the past to direct traffic
> that needs to be NATd from a switch to a router but it was as little
> simpler in that the router's outgoing NAT address was just a normal
> sub-interface and not a loopback. 
>
> Thanks for any help.
> jeff
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>