Configure and Verify NAT on Nexus

Available Languages

Download Options

  • ePub     (217.3 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (157.5 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 5, 2023
Document ID:221048

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Introduction

This document describes how to configure and verify Network Address Translation (NAT) and twice NAT.

Prerequisites

Requirements

Cisco recomends that you have knowledge of these topics:

  • NAT
  • NXOS Platform
  • Ethanalyzer understanding

Components Used

Name Paltform Version
N9K1  N9K-C93108TC-EX  9.3(10)
N9K2 N9K-C93108TC-EX  9.3(10)
N9K3 N9K-C93108TC-EX 
 9.3(10)

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Network Diagram

Network Topology

Configure translation Global inside IP

Inside Global IP:10.1.1.1

Inside Local IP:192.168.1.1

N9K1 N9K2 N9K3 
interface Ethernet1/1
ip address 10.10.10.10/24
no shut

interface loopback 0
ip address 10.1.1.1/32

ip route 0.0.0.0/0 10.10.10.1














feature nat

ip access-list tac-nat-inside 
permit ip host 10.1.1.1 any 

ip nat pool tac-nat-inside-pool 192.168.1.1 192.168.1.1 prefix-length 32
ip nat inside source list tac-nat-inside pool tac-nat-inside-pool dynamic add-route

interface Ethernet1/1
   ip nat inside
   ip address 10.10.10.11/24
   no shut

interface Ethernet1/2
   ip nat outside
   ip address 10.20.20.21/24
   no shut

ip route 10.3.3.3/32 10.20.20.20

ip route 10.1.1.1/32 10.10.10.10
 
interface Ethernet1/2
   ip address 10.20.20.20/24
   no shut

interface loopback 0
   ip address 10.3.3.3/32

ip route 0.0.0.0/0 10.20.20.21
note-icon

Note: Note: Since IP 192.168.1.1 does not exist physically on any device, nexus must have a valid route in order to forward traffic to this ip. A manual static route entry can be configured "add route " at the end of the NAT list can be configured. Nexus autognerate a route towards translated ip pointing to the next hop of untranslated IP.

Verify translation Global inside IP

N9K1 N9K2 N9K3 
ethanalyzer local interface inband display-filter icmp limit-captured-frames 0
Capturing on inband
1 2023-09-09 00:34:03.617811110 10.3.3.3 → 10.1.1.1 ICMP 158 Echo (ping) request  id=0xd923, seq=0/0, ttl=254





sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
any  192.168.1.1         10.1.1.1            ---                ---

show ip route 192.168.1.1
192.168.1.1/32, ubest/mbest: 1/0
  via 10.10.10.10 [1/0], 00:48:06, NAT
 
HOST2# ping 192.168.1.1 source 10.3.3.3
PING 192.168.1.1 (192.168.1.1) from 10.3.3.3: 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=253 time=1.175 ms
N9K1 receives translated packet destined to 10.1.1.1.

N9K2 translates Inside local IP (192.168.1.1) to Inside global ip (10.1.1.1).

With command "add route" a route towards translated route is autogenerated

Since nexus only has Inside configuration, nexus only display Inside information.

N9K2 initiates a ping to inside local  ip 192.168.1.1 .

Configure translation from Global outside IP

Outside Global IP:10.3.3.3

Outside Local IP:172.16.3.3

N9K1 N9K2 N9K3 
interface Ethernet1/1
   ip address 10.10.10.11/24
   no shut

interface loopback 0
   ip address 10.1.1.1/32

ip route 0.0.0.0/0 10.10.10.11














feature nat

ip access-list tac-nat-outside
permit ip host 10.3.3.3 any 

ip nat pool tac-nat-outisde-pool 172.16.3.3 172.16.3.3 prefix-length 32
ip nat outside source list tac-nat-outside pool tac-nat-outisde-pool dynamic add-route

interface Ethernet1/1
   ip nat inside
   ip address 10.10.10.11/24
   no shut
 
interface Ethernet1/2
   ip nat outside
   ip address 10.20.20.21/24
   no shut

ip route 10.3.3.3/32 10.20.20.20

ip route 10.1.1.1/32 10.10.10.10
 
interface Ethernet1/2
   ip address 10.20.20.20/24
   no shut

interface loopback 0
   ip address 10.3.3.3/32

ip route 0.0.0.0/0 10.20.20.21

note-icon

Note: Note: Since IP 172.16.3.3 does not exist physically on any device, nexus must have a valid route in order to forward traffic to this IP. A manual static route entry can be configured "add route " at the end of the NAT list can be configured. Nexus autognerate a route towards translated IP pointing to the next hop of untranslated IP.

Verify translation from Global outside IP

N9K1 N9K2 N9K3 
ping 172.16.3.3 source 10.1.1.1
PING 172.16.3.3 (172.16.3.3) from 10.1.1.1: 56 data bytes
64 bytes from 172.16.3.3: icmp_seq=0 ttl=253 time=1.103 ms





sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
any ---                ---                172.16.3.3    10.3.3.3

show ip route 172.16.3.3
172.16.3.3/32, ubest/mbest: 1/0
    via 10.20.20.20 [1/0], 00:48:06, NAT
 
ethanalyzer local interface inband display-filter icmp limit-captured-frames 0
Capturing on 'ps-inb'
1 2023-09-09 00:34:03.617811110 10.1.1.1 → 10.3.3.3 ICMP 158 Echo (ping) request  id=0xd923, seq=0/0, ttl=254
N9K1 initiates a ping to Outside ilocal ip 172.16.3.3.

N9K2 translates Outside local IP (192.168.3.3) to Outside global ip (10.3.3.3).

With command "add route" a route towards translated route is  autogenerated

Since nexus only has Outside configuration, nexus only displays Outside information.

 N9K3 receives translated packet destined to 10.3.3.3 .

Configure translation  Global Inside/Outside IP (Twice Nat)

Outside Global IP:10.3.3.3

Outside Local IP:172.16.3.3

Inside Global IP:10.1.1.1

Inside Local IP:192.168.1.1

N9K1 N9K2 N9K3 
interface Ethernet1/1
   ip address 10.10.10.11/24
   no shut

interface loopback 0
   ip address 10.1.1.1/32

ip route 0.0.0.0/0 10.10.10.11






























feature nat

ip access-list tac-nat-outside
permit ip host 10.3.3.3 any 

ip access-list tac-nat-inside 
permit ip host 10.1.1.1 any 

For Outside Twice translation nexus need 2 source list, one static Inside and one Dynamic Outside.
Both of them needs to match the same group.

ip nat pool tac-nat-outisde-pool 172.16.3.3 172.16.3.3 prefix-length 32  
ip nat outside source list tac-nat-outside pool tac-nat-outisde-pool group 2 dynamic add-route 
ip nat inside source static 10.1.1.1 192.168.1.1 group 2 dynamic add-route


For Inside Twice translation nexus need 2 source list, one static Outside and one Dynamic Inside.
Both of them needs to match the same group.


ip nat pool tac-nat-inside-pool 192.168.1.1 192.168.1.1 prefix-length 32
ip nat inside source list tac-nat-inside pool tac-nat-inside-pool group 1 dynamic add-route
ip nat outside source static 10.3.3.3 172.16.3.3 group 1 dynamic add-route

interface Ethernet1/1
   ip nat inside
   ip address 10.10.10.11/24
   no shut
 
interface Ethernet1/2
   ip nat outside
   ip address 10.20.20.21/24
   no shut

ip route 10.3.3.3/32 10.20.20.20

ip route 10.1.1.1/32 10.10.10.10
 
interface Ethernet1/2
   ip address 10.20.20.20/24
   no shut

interface loopback 0
   ip address 10.3.3.3/32

ip route 0.0.0.0/0 10.20.20.21
note-icon

Note: Note: Since IP 172.16.3.3 nor 192.168.1.1 does not exist physically on any device, nexus must have a valid route in order to forward traffic to this ip. A manual static route entry can be configured "add route " at the end of the NAT list can be configured. Nexus autognerates a route towards translated ip pointing to the next hop of untranslated IP.

Verify translation Global Inside/Outside IP (Twice Nat)

N9K1 N9K2 N9K3 
ethanalyzer local interface inband display-filter icmp limit-captured-frames 0
Capturing on inband
1 2023-09-09 00:34:03.617811110 172.16.3.3 → 10.1.1.1 ICMP 158 Echo (ping) request  id=0xd923, seq=0/0, ttl=254









sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.1.1:0 10.1.1.1:0          172.16.3.3:37734 10.3.3.3:37734

show ip route 192.168.1.1
192.168.1.1/32, ubest/mbest: 1/0
  via 10.10.10.10 [1/0], 00:48:06, NAT

show ip route 172.16.3.3
172.16.3.3/32, ubest/mbest: 1/0
  via 10.20.20.20 [1/0], 00:48:06, NAT
 
HOST2# ping 192.168.1.1 source 10.3.3.3
PING 192.168.1.1 (192.168.1.1) from 10.3.3.3: 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=253 time=1.175 ms
N9K1 receives translated packet destined to 10.1.1.1 .

N9K2 translates Inside local IP (192.168.1.1) to Inside global ip (10.1.1.1).

N9K2 translates Outside local IP (192.168.3.3) to Outside global ip (10.3.3.3).

With command "add route" a route towards translated route is autogenerated

Since nexus only has Inside configuration, nexus only display Inside information.

N9K2 initiates a ping to inside local  ip 192.168.1.1 .

Revision History

Revision Publish Date Comments
1.0
05-Oct-2023
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Juan Carlos Gandaria Alonso
    Escalation Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products