One-to-one (1:1) Layer 2 NAT is a service that allows the assignment of a unique public IP address to an existing private IP address (end device), so that the end device can communicate on both the private and public subnets. This service is configured in a NAT-enabled device and is the public “alias” of the IP address physically programmed on the end device. This is typically represented by a table in the NAT device.

Layer 2 NAT has two translation tables where private-to-public and public-to-private subnet translations can be defined. Layer 2 NAT is a hardware based implementation that provides the same high level of (bump-on-the-wire) wire-speed performance. This implementation also supports multiple VLANs through the NAT boundary for enhanced network segmentation.

In the following example, Layer 2 NAT translates addresses between sensors on a 192.168.1.x network and a line controller on a 10.1.1.x network.

1. The 192.168.1.x network is the inside/internal IP address space and the 10.1.1.x network is the outside/external IP address space.

2. The sensor at 192.168.1.1 sends a ping request to the line controller by using an “inside” address, 192.168.1.100.

3. Before the packet leaves the internal network, Layer 2 NAT translates the source address (SA) to 10.1.1.1 and the destination address (DA) to 10.1.1.100.

4. The line controller sends a ping reply to 10.1.1.1.

5. When the packet is received on the internal network, Layer 2 NAT translates the source address to 192.168.1.100 and the destination address to 192.168.1.1.

For large numbers of nodes, you can quickly enable translations for all devices in a subnet. In the scenario shown in the following figure, addresses from Inside Network 1 can be translated to outside addresses in the 10.1.1.0/28 subnet, and addresses from Inside Network 2 can be translated to outside addresses in the 10.1.1.16/28 subnet. All addresses in each subnet can be translated with one command.

The following figure shows an IE 5000 NAT configuration at the distribution level. In this example, the IE 5000 connects to devices in the private network through through Catalyst 2960 switches. The Catalyst switches at the access layer are not performing NAT. The IE5000 is performing L2 NAT on three interfaces for three different access switches. The IE switches are capable of supporting 128 instances of L2 NAT. In this example, only three of the 128 are shown. An entire subnet can be configured in a single L2 NAT instance.

The IE 5000 NAT configuration for the diagram shown in the figure above is as follows:

Instance10: 
 inside from network 192.168.0.0 to 10.10.10.0 mask 255.255.255.0
 outside from host 10.10.10.254 to 192.168.9.254 gateway
Instance11:
 inside from network 192.168.0.0 to 10.10.11.0 mask 255.255.255.0
 outside from host 10.10.11.254 to 192.168.9.254 gateway
Instance12:
 inside from network 192.168.0.0 to 10.10.12.0 mask 255.255.255.0
 outside from host 10.10.12.254 to 192.168.9.254 gateway
.
.
.
Interface vlan 10
 ip address 10.10.10.254 mask 255.255.255.0
Interface vlan 11
 ip address 10.10.11.254 mask 255.255.255.0
Interface vlan 12
Ip address 10.10.12.254 mask 255.255.255.0
Interface gig 1/1
 switchport access vlan 10
 l2nat instance10
Interface gig 1/2
 switchport access vlan 11
 l2nat instance11
Interface gig 1/3
 switchport access vlan 12
 l2nat instance12

• Only IPv4 addresses can be translated.

• Layer 2 NAT applies only to unicast traffic. You can permit or allow untranslated unicast traffic, multicast traffic, and IGMP traffic.

• Layer 2 NAT does not support one-to-many and many-to-one IP address mapping.

• Layer 2 NAT supports one-to-one mapping between external and internal IP addresses.

• Layer 2 NAT cannot save on public IP addresses.

• FTP traffic does not work because the embedded IP address is not translated.

• If you configure a translation for a Layer 2 NAT host, do not configure it as a DHCP client.

• Certain protocols such as ARP and ICMP do not work transparently across Layer 2 NAT but are “fixed up” by default. “Fixed up” means that changes are made to IP addresses embedded in the payload of IP packets for the protocols to work.

• The interfaces that support NAT instance configurations are as follows:

  • IE2000: Gig 1/1 and Gig 1/2 (uplinks)

  • IE4000: Gig 1/1 - Gig 1/4 (uplinks)

  • IE4010: all interfaces are capable of supporting L2NAT. There is an interface group restriction on the IE4010. For interfaces in range Gig 1/1 - 6 and Gig 1/13 - 1/18 (12 leftmost interfaces), only 4 interfaces can simultaneously support NAT instances. Additionally, for the rightmost interfaces Gig 1/7 - 1/12, Gig 1/19 - 1/24, and Gig 1/25 - 1/28, only 4 interfaces can simultaneously support NAT instances.

  • IE5000: all interfaces are capable of supporting L2NAT. There is an interface group restriction on the IE5000. For interfaces in range Gig 1/1 - 1/6 and Gig 1/13 - 1/18 (12 leftmost interfaces), only 4 interfaces can simultaneously support NAT instances. Additionally, for the rightmost interfaces Gig 1/7 - 12 and Gig 1/19 - 1/24 and TenGig 1/1 - 1/4, only 4 interfaces can simultaneously support NAT instances.

  Note

  On IE4010 and IE5000 platforms, when you configure an L2NAT instance on the downlink ports (Gig 1/1 – Gig 1/24), you must configure the “inside” and “outside” IP addresses in the corresponding translation maps in reverse order compared to a translation map on uplink ports (Gig1/25, 28 or TenGig 1/1 – 1/4).

• The downlink port can be VLAN, trunk, or Layer 2 channel.

• You can configure 128 Layer 2 NAT instances on the switch.

• Up to 128 VLANs are allowed to have Layer 2 NAT configuration.

• The management interface is behind the Layer 2 NAT function. Therefore this interface should not be on the private network VLAN. If it is on the private network VLAN, assign an inside address and configure an inside translation.

• Because L2NAT is designed to separate outside and inside addresses, we recommend that you do not configure addresses of the same subnet as both outside and inside addresses.

To verify that Layer 2 NAT is working correctly and has connectivity, ping the translated IP address configured in the Layer 2 NAT translation maps and not the real IP addresses configured on the end devices. Use the show commands listed below to display Layer 2 NAT configuration.

In this scenario, A1 needs to communicate with a logic controller (LC) that is directly connected to the uplink port. An Layer 2 NAT instance is configured to provide an address for A1 on the outside network (10.1.1.1) and an address for the LC on the inside network (192.168.1.250).

Now this communication can occur:

1. A1 sends an ARP request: SA: 192.168.1.1DA: 192.168.1.250.

2. Cisco Switch A fixes up the ARP request:SA:10.1.1.1DA: 10.1.1.200.

3. LC receives the request and learns the MAC Address of 10.1.1.1.

4. LC sends a response:SA: 10.1.1.200DA: 10.1.1.1.

5. Cisco Switch A fixes up the ARP response:SA: 192.168.1.250DA: 192.168.1.1.

6. A1 learns the MAC address for 192.168.1.250, and communication starts.

Note	The management interface of the switch must be on a different VLAN from the inside network 192.168.1.x.

The following table shows the configuration tasks for this scenario. The Layer 2 NAT instance is created, two translation entries are added, and the instance is applied to the interface. ARP fixups are enabled by default.

Note	This example is based on the IE 2000 switch. For the IE 4000 and IE 5000 switches, the interface numbers may vary.

In this scenario, two machine nodes are preconfigured with addresses in the 192.168.1.x space. Layer 2 NAT translates these addresses to unique addresses on separate subnets of the outside network. In addition, for machine-to-machine communications, the Node A machines need unique addresses on the Node B space and the Node B machines need unique addresses in the Node A space.

• Switch C needs an address in the 192.168.1.x space. When packets come into Node A or Node B, the 10.1.1.254 address of Switch C is translated to 192.168.1.254. When packets leave Node A or Node B, the 192.168.1.254 address of Switch C is translated to 10.1.1.254.

• Node A and Node B machines need unique addresses in the 10.1.1.x space. For quick configuration and ease of use, the 10.1.1.x space is divided into subnets: 10.1.1.0, 10.1.1.16, 10.1.1.32, and so on. Each subnet can then be used for a different node. In this example, 10.1.1.16 is used for Node A, and 10.1.1.32 is used for Node B.

• Node A and Node B machines need unique addresses to exchange data. The available addresses are divided into subnets. For convenience, the 10.1.1.16 subnet addresses for the Node A machines are translated to 192.168.1.16 subnet addresses on Node B. The10.1.1.32 subnet addresses for the Node B machines are translated to 192.168.1.32 addresses on Node A.

• Machines have unique addresses on each network:

Table 2 shows the configuration tasks for Switch A. Table 3 shows the configuration tasks for Switch B.

Note	This example is based on the IE 2000 switch. For the IE 4000 and IE 5000 switches, the interface numbers may vary.

• Cisco Industrial Ethernet 2000 Series Switches Configuration Guides

• Cisco Industrial Ethernet 4000 Series Switches Configuration Guides

• Cisco Industrial Ethernet 4010 Series Switches Configuration Guides

• Cisco Industrial Ethernet 5000 Series Switches Configuration Guides