In Cisco IOS XE
Release 3.5S and later releases, the Match-in-VRF Support for NAT feature
supports NAT of packets that communicate between two hosts within the same VPN.
The VRF-aware NAT
enables communication between hosts in the private address space in different
VPN routing and forwarding (VRF) instances and common servers in the Internet
or the global domain. Because IP addresses of the inside hosts overlap with
each other, the VRF-aware NAT facilitates communication between these hosts by
converting overlapped inside IP addresses into globally unique addresses. The
Match-in-VRF Support for NAT feature extends VRF-aware NAT by supporting
intra-VPN NAT capability. In the intra-VPN NAT, both the local and global
address spaces for end hosts are isolated to their respective VPNs, and as a
result translated addresses for hosts overlap each other. To separate the
address space for translated addresses among VPNs, configure the
match-in-vrf
keyword in the NAT mapping (ip nat inside
source command) configuration. Both static and dynamic NAT
configurations support the
match-in-vrf
keyword.
Note |
All NAT commands
that support VRF support the
match-in-vrf
keyword. Because NAT outside rules (ip nat outside source command) support the
match-in-VRF functionality by default, the
match-in-vrf
keyword is not supported by NAT outside rules.
|
In VRF-aware NAT,
the IP alias and Address Resolution Protocol (ARP) entries for inside global
addresses are configured in the global domain. For intra-VPN NAT, the IP alias
and ARP entries for inside global addresses are configured in the VRF through
which the translation happens. In intra-VPN NAT, configuration of the
match-in-vrf
keyword implies that at least one NAT outside interface is configured in the
same VRF. The ARP entry in that VRF replies to the ARP request from the outside
host.
If inside addresses
are configured, the match-in-VRF is determined through inside mappings during
the address translation of VRF traffic. If you have configured only outside
mapping of IP addresses for address translations, the match-in-VRF will work.
When a translation entry is created with both inside and outside mappings, the
match-in-vrf
keyword is determined by the inside mapping.
The Match-in-VRF
Support for NAT feature supports the configuration of multiple dynamic mappings
with the same IP address pool.
The following table
provides you information about VRF support for NAT:
NAT
Inside Interface
|
NAT
Outside Interface
|
Global
|
Global
IPv4 (non-MPLS)
|
MPLS IP
|
VRF
Note
|
You must use the match-in-vrf keyword in the configuration to indicate that communication is occurring within the VRF.
|
|
VRF
|
VRF
Note
|
Both VRFs must be in the same inside interface for this configuration to work.
|
|
VRF
|
MPLS
Note
|
You must use the match-in-vrf keyword in the configuration to indicate that communication is occurring within the VRF.
|
|
VRF
|
Global IPv4 (non-MPLS)
|