Service-side NAT Object Tracker

Feature history of service-side NAT object tracker

This table describes the developments of this feature, by release.

Table 1. Feature history

Feature name

Release information

Description

Service-Side NAT Object Tracker Support

Cisco IOS XE Catalyst SD-WAN Release 17.8.1a

Cisco vManage Release 20.8.1

This feature supports tracking LAN prefixes and LAN interfaces for service-side inside static NAT.

When an associated object tracker changes state (up or down), the device adds or removes the corresponding NAT route from the routing table through OMP. View event notifications in Cisco SD-WAN Manager to monitor NAT route and interface changes.

Service-side NAT object tracker

A service-side NAT object tracker is a tracking mechanism that

  • monitors LAN prefixes and LAN interfaces to control NAT route advertisements through OMP based on their operational state

  • detects changes in tracked object states and communicates them to interested client processes immediately or after a configured delay, and

  • adds or removes corresponding NAT route advertisements through OMP based on the tracked object states.

NAT route tracking and advertisement management

  • Each tracked object has a unique number that client processes use to identify and track it.

  • The tracking process periodically polls tracked objects to detect changes in their states.

  • If a tracked prefix is missing from the routing table, the tracker removes the corresponding NAT prefix route from OMP.

  • You can configure the tracker through Cisco SD-WAN Manager, device CLI, or a CLI add-on template.

  • The track keyword is available in the ip nat inside source command.

  • You can monitor NAT route advertisement changes through event logs in Cisco SD-WAN Manager.

Restrictions for service-side NAT object tracker

Observe these restrictions when you use the service-side NAT object tracker.

  • Object tracking for service-side static NAT supports only inside static NAT and inside dynamic NAT.

  • Outside static NAT and NAT DIA are not supported.

  • Outside translations and port forwarding are not supported.

  • Cisco SD-WAN Manager does not support IP route tracking.

    Use a device CLI template or CLI add-on template to configure IP route tracking. You can track an interface as an object using Cisco SD-WAN Manager.

Use case for service-side NAT object tracker

When a LAN interface or LAN prefix goes down, the service-side NAT object tracker automatically transitions to a down state. Cisco SD-WAN Manager event logs show when NAT route advertisements are added or removed, allowing you to monitor route advertisement changes.

How to configure the service-side NAT with an object tracker

Summary

This workflow outlines ordered steps to set up service-side NAT: configure a centralized data policy, create the tracker, configure dynamic or static NAT, define a static NAT pool, and associate the tracker with the inside static NAT pool.

Workflow

  1. Configure a centralized data policy for the Cisco Catalyst SD-WAN Controller to include a NAT pool number and an action. For more information on configuring and applying a centralized data policy for the service-side NAT object tracker, see Create and Apply a Centralized Data Policy for Service-Side NAT.
  2. Configure a service-side NAT object tracker or a tracker group using a Cisco System template. For more information on configuring a service-side NAT object tracker, see Configure Service-Side NAT Object Tracker.
  3. (Optional) Configure service-side dynamic NAT. For more information on configuring service-side dynamic NAT, see Configure Service-Side Dynamic NAT.
  4. Configure a NAT pool for service-side static NAT. For more information on configuring a NAT pool for service-side static NAT, see Configure Service-Side Static NAT.
  5. Associate the service-side NAT object tracker with the static inside NAT pool using a Cisco VPN template. For more information on associating the service-side NAT object tracker with the static inside NAT pool using a Cisco VPN template, see Associate the Service-Side NAT Object Tracker with a NAT Pool Using a Cisco VPN Template.

Configure service-side NAT object tracker using templates

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

Step 2

Select Feature Templates.

Step 3

To edit a Cisco System template, select … adjacent to the template name and choose Edit.

Step 4

Select Tracker and choose New Object Tracker to configure the service-side NAT object tracker parameters.

Table 2. Service-side NAT object tracker parameters
Field Description

Tracker Type

Choose Interface or Route to track a LAN interface or LAN prefix.

Object ID

Enter the object ID number.

The object number identifies the tracked object and can be from 1 to 1000.

Interface

Choose a global or device-specific interface.

Step 5

Click Add.

Step 6

Click Update.

Step 7

(Optional) To create a tracker group, choose Tracker, and click Tracker Groups > New Object Tracker Groups to configure the service-side NAT object tracker.


Note

Ensure that you have created two trackers to create a tracker group.
Table 3. Service-side NAT object tracker group parameters

Field

Description

Group Tracker ID

Enter the name of the tracker group.

Tracker ID

Enter the name of the object tracker that you want to group.

Criteria

Choose AND or OR.

  • AND: Reports the transport interface as active only when both associated trackers report the route as active.

  • OR Reports the transport interface as active when either associated tracker reports the route as active.

Step 8

Select Add and then Update .

Configure service-side NAT object tracker using CLI commands

Use this task to configure a service-side NAT object tracking to control NAT translation behavior using centralized data policy and tracked conditions such as route reachability or interface state.

Procedure

Step 1

Configure a centralized data policy on the Cisco Catalyst SD-WAN Controller with a NAT pool number and an action, as shown in the following example.

Example:

policy
 data-policy ssn_policy
  vpn-list ssn_vpn_list
   sequence 10
    match
     destination-ip 192.168.21.0/24 
!
    action accept
     count counter_dst_192
     nat pool 1
    !
   !
   sequence 20
    match
     destination-ip 10.11.11.0/27  
  !
    action accept
     count counter_dst_10   
     nat pool 2
    !
   !
   sequence 101
    match
     source-ip 192.168.11.0/24   
     protocol  1
    !
    action accept
     nat pool 1
    !
   !
   default-action accept
  !
 !
 lists
  vpn-list ssn_vpn_list
   vpn 1
  !
  site-list ssn_site_list
   site-id 500
  !
 !
!
apply-policy
 site-list ssn_site_list
  data-policy ssn_policy all
 !
!

Step 2

Configure an inside static NAT mapping and associate it with a tracker.

Example:

Device(config)# ip nat inside source static 192.168.11.10 10.11.11.10 vrf 1 
match-in-vrf track 1

Step 3

Configure an inside static NAT pool with a prefix length:

Example:

Device(config)# ip nat pool natpool2 10.11.11.0 10.11.11.25 prefix-length 27

Step 4

Configure an inside static NAT global pool with overload mode and a tracker ID:

Example:

Device(config)# ip nat inside source list global-list pool natpool2 vrf 1 match-in-vrf overload track 1

Step 5

Track IP route reachability:

Example:

Device(config)# track 1 ip route 192.168.11.0 255.255.255.0 reachability
Device(config-track)# ip vrf 1

Note

The tracker considers the object up when the routing table contains the specified route and the route is accessible.

Step 6

Track the line-protocol state of an interface:

Example:

Device(confige)# track 1 interface GigabitEthernet5.101 line-protocol

Configure service-side NAT object tracker using a CLI add-on template

Before you begin

Create a new CLI add-on template or edit an existing CLI add-on template.

Follow these steps to configure a service-side NAT object tracker with a CLI add-on template:

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

Step 2

Select Feature Templates.

Step 3

Select Add Template.

Step 4

Choose a device from the device list.

Step 5

Select CLI Add-On Template under Other templates.

Step 6

In the CLI Add-On Template pane, enter the configuration as shown in this example:

Example:

track 1 ip route 192.168.11.0 255.255.255.0 reachability 
ip vrf 1
ip nat pool natpool1 10.11.11.1 10.11.11.30 prefix-length 24
ip nat inside source static 192.168.11.10 10.11.11.10 vrf 1 match-in-vrf pool natpool1 track 1
ip nat inside source list global-list pool natpool1 vrf 1 match-in-vrf overload track 1

Step 7

Select Save.

The CLI add-on template that you created is displayed in the CLI Configuration table.

Step 8

Attach the CLI add-on template to your device.

Associate the service-side NAT object tracker with a NAT pool using a Cisco VPN template

Use this task to associate a service-side NAT object tracker with a NAT pool by editing a Cisco VPN template in Cisco SD-WAN Manager to support tracking-based NAT behavior.

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

Step 2

Select Feature Templates.

Step 3

To edit a Cisco VPN template, select … adjacent to the template name and choose Edit.

Step 4

Configure a NAT pool for dynamic or static NAT.

Step 5

In NAT Direction, change the scope from Default to Global, then select Inside.

Step 6

In Add Object/Object Group Tracker, enter the object ID of the interface or route to track.

Step 7

Select Add and then select Update.

Verify the service-side NAT object tracker configuration

Verify the service-side NAT object tracker configuration by checking tracker state and validating that NAT routes through OMP are present in the routing table.

Verify the service-side NAT object tracker state

To verify the service-side NAT object tracker state, use the show track object-id command. 

Device# show track 1
 Track 1
  Interface GigabitEthernet5.101 line-protocol
  Line protocol is Up
    1 change, last change 01:38:57
  Tracked by:
    NAT 0

In this output, Line protocol is Up (OMP), indicates that the service-side object tracker is up.

Verify NAT routes in the routing table

To verify that OMP advertises NAT routes and adds them to the routing table, use the show ip route vrf command. 

Device# show ip route vrf 1
Routing Table: 1
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected
Gateway of last resort is not set
      10.0.0.0/24 is subnetted, 3 subnets
m        10.11.11.1 [251/0] via 192.168.11.10, 04:03:35, Sdwan-system-intf
m        10.11.11.6 [251/0] via 192.168.13.10, 04:03:35, Sdwan-system-intf
m        10.11.11.30 [251/0] via 192.168.11.21, 04:03:35, Sdwan-system-intf

In this output, Ni - NAT inside is configured.

In this output, the lines beginning with m indicate that the NAT routes are added to the routing table.

Monitor service-side NAT object tracker

Monitor changes to NAT route advertisements and tracked interfaces.

  1. From the Cisco SD-WAN Manager menu, choose Monitor > Logs.

  2. Click Events.