[c-nsp] NAT problem on ISR 4331

[Eugen Şerban]

Hello guys,

I have an ISR 4331 that i'm using for guest and hotspot traffic. For each
network (guest and hotspot) I have created a VRF so I have a proper
separation between them. Also, I have another VRF for the internet
interface. Like this, I'm sure nobody is going to mess-up access lists. The
guest and hotspot traffic then uses gre tunnels to a cloud service that
does proxy and blocks illegal sites (it's a legal requirement).

Then I have two exceptions (to the some outside servers that do DNS also)
that are outside of the tunnels. My problem is that each traffic (guest and
hotspot) need to present a different IP address. I have a public /29 and I
thought about doing as bellow, but the DNS does not work. If I ping the
servers, it works fine and I know the routing works also.

show ip nat translations looks ok, but I still don't receive the DNS
response. The router is directly connected to the internet as are the
clients (the ISR is the DHCP server and gateway for both).

If instead of pools I use the interface (ex: ip nat inside source list
Guest2Internet interface Gi0/0/2 vrf guest overload) everything works. The
problem with this is that both networks will have the same public IP
address.

Have you guys encountered something similar?

Regards,
Eugen



I am using 15.5(3)S2

ip nat translation timeout 60
ip nat translation tcp-timeout 60
ip nat translation udp-timeout 60
ip nat translation dns-timeout 60
no ip nat service all-algs
no ip nat service dns-reset-ttl
!
ip nat pool HotspotNAT 1.2.3.92 1.2.3.92 netmask 255.255.255.248
ip nat pool GuestNAT 1.2.3.91 1.2.3.91 netmask 255.255.255.248
!
ip nat inside source list Guest2Internet pool GuestNAT vrf guest overload
ip nat inside source list Hotspot2Internet pool HotspotNAT vrf hotspot
overload
!
ip access-list extended Guest2Internet
 permit ip 172.16.112.0 0.0.1.255 host 14.22.77.29
 permit ip 172.16.112.0 0.0.1.255 host 18.33.25.41
ip access-list extended Hotspot2Internet
 permit ip 172.16.32.0 0.0.1.255 host 14.22.77.29
 permit ip 172.16.32.0 0.0.1.255 host 18.33.25.41
!
interface GigabitEthernet0/0/1.121
 description Hotspot Vlan
 encapsulation dot1Q 121
 ip vrf forwarding hotspot
 ip address 172.16.32.1 255.255.254.0
 ip nat inside
 no cdp enable
 arp timeout 300
 ip virtual-reassembly
!
interface GigabitEthernet0/0/1.122
 description Guest Vlan
 encapsulation dot1Q 122
 ip vrf forwarding guest
 ip address 172.16.112.1 255.255.254.0
 ip nat inside
 no cdp enable
 arp timeout 300
 ip virtual-reassembly
!
interface GigabitEthernet0/0/2
 description WAN interface 1
 ip vrf forwarding internet
 ip address 1.2.3.91 255.255.255.248 secondary
 ip address 1.2.3.92 255.255.255.248 secondary
 ip address 1.2.3.90 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip verify unicast reverse-path 100
 negotiation auto
 no cdp enable
 arp timeout 300
 ip virtual-reassembly
!