Downloads |
Table Of Contents
Configuring NAT for High Availability
Prerequisites for Configuring NAT for High Availability
Restrictions for Configuring NAT for High Availability
Information About Configuring NAT for High Availability
NAT Stateful Failover for Asymmetric Outside-to-Inside ALG Support
Stateful Failover for Asymmetric Outside-to-Inside Support
How to Configure NAT for High Availability
Configuring the Stateful Failover of NAT
Restrictions for Configuring Stateful Failover of NAT
Configuring SNAT on the Primary (Active) Router
Configuring SNAT on the Backup (Standby) Router
Configuring NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support
Configuring SNAT Primary/Backup
Configuring NAT Static Mapping Support for HSRP
Restrictions for Configuring Static Mapping Support for HSRP
Enabling HSRP on the NAT Interface
Enabling Static NAT in an HSRP Environment
Configuration Example for NAT for High Availability
Examples: Configuring Stateful NAT
Configuration Examples for NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support
Example: Configuring SNAT with HSRP
Example: Configuring SNAT Primary/Backup
Examples: Configuring Static NAT in an HSRP Environment
Feature Information for Configuring NAT for High Availability
Configuring NAT for High Availability
First Published: May 2, 2005Last Updated: February 1, 2011
This module contains procedures for configuring Network Address Translation (NAT) to support the increasing need for highly resilient IP networks. This network resiliency is required where application connectivity needs to continue unaffected by failures to links and routers at the NAT border.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Configuring NAT for High Availability" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for Configuring NAT for High Availability
•
•
•
•
•
Prerequisites for Configuring NAT for High Availability
•
•
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ip_entry_numbrng.html
Note
Restrictions for Configuring NAT for High Availability
•
•
Information About Configuring NAT for High Availability
To configure NAT for High availability, you should understand the following concepts:
•
•
Stateful NAT
Stateful NAT (SNAT) enables continuous service for dynamically mapped NAT sessions. Sessions that are statically defined receive the benefit of redundancy without the need for SNAT. In the absence of SNAT, sessions that use dynamic NAT mappings would be severed in the event of a critical failure and would have to be reestablished.
SNAT can be used with protocols that do not need payload translation.
NAT Stateful Failover for Asymmetric Outside-to-Inside ALG Support
NAT stateful failover for asymmetric outside-to-inside and Application Layer Gateway (ALG) support improves the ability to handle asymmetric paths by allowing multiple routing paths from outside-to-inside, and per-packet load balancing. This feature also provides seamless failover translated IP sessions with traffic that includes embedded IP addressing such as Voice over IP, FTP, and Domain Name System (DNS) applications.
Interaction with HSRP
SNAT can be configured to operate with the Hot Standby Routing Protocol (HSRP) to provide redundancy. Active and Standby state changes are managed by HSRP.
SNAT applies a more global context to the task of forwarding a particular datagram. Consideration is given to understanding the application state along with forwarding. Devices can take action to avoid potential failures that will have less impact on the flow and to the application that is transmitting data. Multiple NAT routers that share stateful context can work cooperatively and thereby increase service availability.
Translation Group
Two or more network address translators function as a translation group. One member of the group handles traffic requiring translation of IP address information. It also informs the backup translator of active flows as they occur. The backup translator can then use information from the active translator to prepare duplicate translation table entries, and in the event that the active translator is hindered by a critical failure, the traffic can rapidly be switched to the backup. The traffic flow continues since the same network address translations are used, and the state of those translations has been previously defined.
Address Resolution with ARP
A device in IP can have both a local address (which uniquely identifies the device on its local segment or LAN) and a network address (which identifies the network to which the device belongs). The local address is more properly known as a data link address because it is contained in the data link layer (Layer 2 of the OSI model) part of the packet header and is read by data-link devices (bridges and all device interfaces, for example). The local address is referred to as the MAC address, because the MAC sub-layer within the data link layer processes addresses for the layer.
To communicate with a device on Ethernet, for example, the Cisco IOS software first must determine the 48-bit MAC or local data-link address of that device. The process of determining the local data-link address from an IP address is called address resolution. The process of determining the IP address from a local data-link address is called reverse address resolution.
The software uses three forms of address resolution: Address Resolution Protocol (ARP), proxy ARP, and Probe (similar to ARP). The software also uses the Reverse Address Resolution Protocol (RARP). ARP, proxy ARP, and RARP are defined in RFCs 826, 1027, and 903, respectively. Probe is a protocol developed by the Hewlett-Packard Company (HP) for use on IEEE-802.3 networks.
ARP is used to associate IP addresses with media or MAC addresses. Taking an IP address as input, ARP determines the associated media address. Once a media or MAC address is determined, the IP address or media address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP).
Stateful Failover for Asymmetric Outside-to-Inside Support
Stateful failover for asymmetric outside-to-inside support enables two NAT routers to participate in a primary/backup design. One of the routers is elected as the primary NAT router and a second router acts as the backup router. As traffic is actively translated by the primary NAT router it updates the backup NAT router with the NAT translation state from NAT translation table entries. If the primary NAT router fails or is out of service, the backup NAT router will automatically take over. When the primary comes back into service it will take over and request an update from the backup NAT router. Return traffic is handled by either the primary or the backup NAT translator and NAT translation integrity is preserved.
When the backup NAT router receives asymmetric IP traffic and performs NAT of the packets, it will update the primary NAT router to ensure both the primary and backup NAT translation tables remain synchronized.
Figure 1 shows a typical configuration that uses the NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support feature.
Figure 1 Stateful NAT Asymmetric Outside-to-Inside Support
Stateful Failover for ALGs
The stateful failover embedded addressing enhancement allows the secondary or backup NAT router to properly handle NAT and delivery of IP traffic. NAT inspects all IP traffic entering interfaces that have been configured with the NAT feature. The inspection consists of matching the incoming traffic against a set of translations rules and performs an address translation if a match occurs. The following are examples:
•
•
•
Some of the applications and protocols that embed source port or IP address information include:
•
•
•
•
•
•
•
A complete list of current ALG protocols supported by Cisco IOS NAT can be found at
http://www.cisco.com/en/US/tech/tk648/tk361/tech_brief09186a00801af2b9.html
How to Configure NAT for High Availability
This module describes three methods for configuring NAT for high availability:
•
•
•
Configuring the Stateful Failover of NAT
The NAT Stateful Failover of Network Address Translation feature represents Phase 1 of the stateful failover capability. It introduces support for two or more network address translators to function as a translation group. A backup router running NAT provides translation services in the event the active translator fails. Protocols that do not need payload translations, such as HTTP and telnet, are supported by stateful NAT (SNAT).
This section contains the following procedures:
•
•
•
Restrictions for Configuring Stateful Failover of NAT
The following applications and protocols are not supported in Phase I:
•
•
•
•
•
•
•
•
SNAT features are not backward compatible. See "Feature Information for Configuring NAT for High Availability" and "Scalability for Stateful NAT" for information on SNAT features and the releases in which they were introduced.
Configuring SNAT with HSRP
Perform this task to configure Stateful NAT using HSRP to provide router backup facilities.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Configuring SNAT on the Primary (Active) Router
Perform this task to manually configure your primary SNAT router. When you have completed this task, perform the steps in the "Configuring SNAT on the Backup (Standby) Router" section.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Configuring SNAT on the Backup (Standby) Router
Perform this task to manually configure your backup (standby) SNAT router.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Configuring NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support
Stateful NAT Phase I required all sessions to pass through the primary NAT router that controlled the NAT translation entries unless the primary NAT router was unavailable. This requirement assured integrity of the translation information by guarding against the possibility of some packets relevant to NAT session control from traversing the backup without the primary being aware of it. Without synchronized IP sessions NAT eventually times out the IP session entries and the result is IP session states that are out of sequence.
This section contains the following procedures:
•
•
Prerequisites for Configuring the NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support Feature
Each router must have the same Network Address Translation (NAT) configurations.
The stateful failover asymmetric outside-to-inside enhancement provides the following benefits:
•
•
Configuring SNAT with HSRP
To configure your Hot Standby Router Protocol (HSRP) router with Stateful Network Address Translation (SNAT), use the following commands:
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
Configuring SNAT Primary/Backup
Use the following commands to enable the NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support feature:
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring NAT Static Mapping Support for HSRP
When an Address Resolution Protocol (ARP) query is triggered for an address that is configured with NAT static mapping and owned by the router, NAT responds with the burned in MAC (BIA MAC) address on the interface to which the ARP is pointing. Two routers are acting as HSRP active and standby. Their NAT inside interfaces must be enabled and configured to belong to a group.
Benefits of Configuring Static Mapping Support for HSRP are the following:
•
•
Both of the following tasks are required and must be performed on both the active and standby routers to configure NAT static mapping support for HSRP:
•
•
Restrictions for Configuring Static Mapping Support for HSRP
•
•
•
Enabling HSRP on the NAT Interface
Perform this task to enable HSRP on the NAT interface of both the active and standby routers.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
What to Do Next
Go to the next section and enable static NAT in the HSRP environment.
Enabling Static NAT in an HSRP Environment
To enable static mapping support with HRSP for high availability, perform this task on both the active and standby routers.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuration Example for NAT for High Availability
This section provides the following configuration examples:
•
•
•
Examples: Configuring Stateful NAT
The following examples show configuring stateful NAT with HSRP and configuring stateful NAT primary and backup routers.
SNAT with HSRP Example
ip nat Stateful id 1redundancy SNATHSRPmapping-id 10ip nat pool SNATPOOL1 10.1.1.1 10.1.1.9 prefix-length 24ip nat inside source route-map rm-101 pool SNATPOOL1 mapping-id 10 overloadip classlessip route 10.1.1.0 255.255.255.0 Null0no ip http serverip pim bidir-enableConfiguring SNAT Primary/Backup Example
ip nat Stateful id 1primary 10.88.194.17peer 10.88.194.18mapping-id 10!ip nat Stateful id 2backup 10.88.194.18peer 10.88.194.17mapping-id 10Configuration Examples for NAT Stateful Failover for Asymmetric Outside-to-Inside and ALG Support
This section contains the following examples:
•
•
Example: Configuring SNAT with HSRP
The following example shows how to configure SNAT with HSRP.
ip nat Stateful id 1redundancy SNATHSRPmapping-id 10ip nat pool SNATPOOL1 11.1.1.1 11.1.1.9 prefix-length 24ip nat inside source route-map rm-101 pool SNATPOOL1 mapping-id 10 overloadip classlessip route 11.1.1.0 255.255.255.0 Null0no ip http serverip pim bidir-enableExample: Configuring SNAT Primary/Backup
The following example shows how to configure SNAT on the primary/backup router.
ip nat Stateful id 1primary 10.88.194.17peer 10.88.194.18mapping-id 10!ip nat Stateful id 2backup 10.88.194.18peer 10.88.194.17mapping-id 10Examples: Configuring Static NAT in an HSRP Environment
The following example shows support for NAT with a static configuration in an HSRP environment. Two routers are acting as HSRP active and standby, and the NAT inside interfaces are HSRP enabled and configured to belong to the group HSRP1.
Active Router Configuration
interface BVI10ip address 192.168.5.54 255.255.255.255.0no ip redirectsip nat insidestandby 10 priority 105 preemptstandby 10 name HSRP1standby 10 ip 192.168.5.30standby 10 track Ethernet2/1!!ip default-gateway 10.0.18.126ip nat inside source static 192.168.5.33 10.10.10.5 redundancy HSRP1ip classlessip route 10.10.10.0 255.255.255.0 Ethernet2/1ip route 172.22.33.0 255.255.255.0 Ethernet2/1no ip http serverStandby Router Configuration
interface BVI10ip address 192.168.5.56 255.255.255.255.0no ip redirectsip nat insidestandby 10 priority 100 preemptstandby 10 name HSRP1standby 10 ip 192.168.5.30standby 10 track Ethernet3/1!ip default-gateway 10.0.18.126ip nat inside source static 192.168.5.33 3.3.3.5 redundancy HSRP1ip classlessip route 10.0.32.231 255.255.255 Ethernet3/1ip route 10.10.10.0 255.255.255.0 Ethernet3/1no ip http serverAdditional References
Related Documents
Cisco IOS commands
NAT commands: complete command syntax, command mode, command history, usage guidelines, and examples
IP Access List Sequence Numbering
IP Access List Sequence Numbering document
NAT configuration tasks
NAT maintenance
Using NAT with MPLS VPNs
Standards
MIBs
•
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Feature Information for Configuring NAT for High Availability
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 1 Feature Information for Configuring NAT for High Availability
NAT Stateful Failover for Asymmetric Outside-to-Inside ALG Support
12.3(7)T
The NAT Stateful Failover for Asymmetric Outside-to-Inside and Application Layer Gateway (ALG) Support feature improves the ability to handle asymmetric paths by allowing multiple routing paths from outside-to-inside, and per-packet load balancing. This feature also provides seamless failover translated IP sessions with traffic that includes embedded IP addressing such as Voice over IP, FTP, and Domain Name System (DNS) applications.
The following sections provide information about this feature:
•
NAT Stateful Failover of Network Address Translation
12.2(13)T
The NAT Stateful Failover of Network Address Translation feature represents Phase 1 of the stateful failover capability. It introduces support for two or more network address translators to function as a translation group.
The following sections provide information about this feature:
•
NAT—Static Mapping Support with HSRP for High Availability
12.2(4)T
12.2(4)T2
Cisco IOS XE Release 2.1Static mapping support for HSRP allows the option of having only the HSRP active router respond to an incoming ARP for a router configured with a NAT address.
The following sections provide information about this feature:
•
•
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2005-2011 Cisco Systems, Inc. All rights reserved.
