Cisco IE 2000 Switch Software Configuration Guide, Cisco IOS Release 15.0(2)EB

Conceptual Overview

One-to-one (1:1) Layer 2 NAT is a service that allows the assignment of a unique public IP address to an existing private IP address (end device), so that the end device can communicate on both the private and public subnets. This service is configured in a NAT enabled device and is the public “alias” of the IP address physically programmed on the end device. This is typically represented by a table in the NAT device.

Layer 2 NAT has two translation tables where private-to-public and public-to-private subnet translations can be defined. Layer 2 NAT is a hardware based implementation which provides the same high level of (bump-on-the-wire) performance throughout switch loading. This implementation also supports multiple VLAN’s through the NAT boundary for enhanced network segmentation. Ring architecture support is built into Layer 2 NAT which allows for redundancy through the NAT boundary.

In Figure 46-1 Layer 2 NAT translates addresses between sensors on a 192.168.1.x network and a line controller on a 10.1.1.x network.

1. The sensor at 192.168.1.1 sends a ping request to the line controller by using an “inside” address, 192.168.1.100.

2. Before the packet leaves the internal network, Layer 2 NAT translates the source address to 10.1.1.1 and the destination address to 10.1.1.100.

3. The line controller sends a ping reply to 10.1.1.1.

4. When the packet is received on the internal network, Layer 2 NAT translates the source address to 192.168.1.100 and the destination address to 192.168.1.1.

Figure 46-1 Translating Addresses Between Networks

For large nodes, you can quickly enable translations for all devices in a subnet. In this scenario, addresses from Inside Network 1 can be translated to outside addresses in the 10.1.1.0/28 subnet, and addresses from Inside Network 2 can be translated to outside addresses in the 10.1.1.16/28 subnet. All addresses in each subnet can be translated with one command.

Default Layer 2 NAT Settings

Setting Up Layer 2 NAT

To set up Layer 2 NAT, follow these steps. Refer to the examples in this chapter for more details.

Basic Inside-to-Outside Communications Example

Figure 46-2 Basic Inside-to-Outside Communications

In this scenario, A1 needs to communicate with a logic controller LC that is directly connected to the uplink port. An Layer 2 NAT instance is configured to provide an address for A1 on the outside network (10.1.1.1) and an address for the LC on the inside network (192.168.1.250).

Now this communication can occur:

1. A1 sends an ARP request:
SA: 192.168.1.1
DA: 192.168.1.250

2. Cisco Switch A fixes up the ARP request:
SA:10.1.1.1
DA: 10.1.1.200

3. LC receives the request and learns the MAC Address of 10.1.1.1.

4. LC sends a response:
SA: 10.1.1.200
DA: 10.1.1.1

5. Cisco Switch A fixes up the ARP response:
SA: 192.168.1.250
DA: 192.168.1.1

6. A1 learns the MAC address for 192.168.1.250, and communication starts.

Note The management interface of the switch must be on a different VLAN from the inside network 192.168.1.x.

Table 46-2 shows the configuration tasks for this scenario. The Layer 2 NAT instance is created, two translation entries are added, and the instance is applied to the interface. ARP fixups are enabled by default.

Duplicate IP Addresses Example

Figure 46-3 Duplicate IP Addresses

In this scenario, two machine nodes are pre-configured with addresses in the 192.168.1.x space. Layer 2 NAT is used to translate these addresses to unique addresses on separate subnets of the outside network. In addition, for machine-to-machine communications, the Node A machines need unique addresses on the Node B space and the Node B machines need unique addresses in the Node A space.

• Switch C needs an address in the 192.168.1.x space. When packets come into Node A or Node B, the 10.1.254 address of Switch C is translated to 192.168.1.254. When packets leave Node A or Node B, the 192.168.1.254 address of Switch C is translated to 10.1.1.254.
• Node A and Node B machines need unique addresses in the 10.1.1.x space. For quick configuration and ease of use, the 10.1.1.x space is divided into subnets: 10.1.1.0, 10.1.1.16, 10.1.1.32, and so on. Each subnet can then be used for a different node. In this example, 10.1.1.16 is used for Node A, and 10.1.1.32 is used for Node B.
• Node A and Node B machines need unique addresses to exchange data. The available addresses are divided into subnets. For convenience, the 10.1.1.16 subnet addresses for the Node A machines are translated to 192.168.1.16 subnet addresses on Node B. The10.1.1.32 subnet addresses for the Node B machines are translated to 192.168.1.32 addresses on Node A.
• Machines have unique addresses on each network:

	Address in Node A	Address in Outside Network	Address in Node B
Switch A network address	192.168.1.0	10.1.1.16	192.168.1.16
A1	192.168.1.1	10.1.1.17	192.168.1.17
A2	192.168.1.2	10.1.1.18	192.168.1.18
A3	192.168.1.3	10.1.1.19	192.168.1.19
Cisco Switch B network address	192.168.1.32	10.1.1.32	192.168.1.0
B1	192.168.1.33	10.1.1.33	192.168.1.1
B2	192.168.1.34	10.1.1.34	192.168.1.2
B3	192.168.1.35	10.1.1.35	192.168.1.3
Switch C	192.168.1.254	10.1.1.254	192.168.1.254

Table 46-4 shows the configuration tasks for Switch A. Table 46-5 shows the configuration tasks for Cisco Switch B.

Related Documents

Standards

MIBs

RFCs

Technical Assistance