Hi Jeff,
Not sure if this is the best solution, but at my office we have a
primary link and a backup link and we NAT out of the loopback so our
telnet and SSH sessions don't crash on us if we ever switch links.
Here are the relevant bits of config (on 1811)
interface Loopback0
ip nat outside
interface FastEthernet0
description Primary link
ip nat outside
interface FastEthernet1
description Backup link
ip nat outside
interface Vlan100
description Internal Network
ip nat inside
ip nat inside source list 11 interface Loopback0 overload
Hope this helps.
Oliver
Jeff Behl wrote:
i've got two 3560s, each with a privately addressed point-to-point link
to a 2851 (a trunked gig interface for each) and both connected to an ISP:
ISP---3560----p2p-----
2851
ISP---3560----p2p-----
The 3560s are connected to the ISP and have a public /25 routed to them
via p2p links. They also have a number of private networks that contain
numerous hosts that they act as the gateway for (HSRP). The 3560s
advertise a default route via ospf which is picked up by the 2851. They
also have a static default pointing to the ISP.
The 2851 has a couple public /32 addresses on loopbacks which are
advertised via ospf and picked up by the 3560s (i've split the /25 into
a few different blocks). One of them acts as a static IPSEC/GRE VPN
tunnel endpoint, and I'd like the other to be an external NAT
interface. The reason for this setup was to be able to maintain the VPN
link during the loss of one of the switches. To this end everything is
working as expected, at least in terms of the VPN tunnel.
But now the trickier part...I'd like some of the hosts on the private
networks for which the 3560s are doing the routing to be able to get to
the internet via NAT. As the 3560s don't do NAT, it has to be the 2851
that does it. I'm looking for suggestions on the most elegant solution
for doing this?? Basically, one of the loopbacks on the 2851 would be
the outgoing IP address for NAT translations. Though I've not used VRFs
before, I'm getting inklings they could be used in a scenario such as
this? The other solution seems to be some sort of policy based
routing. I've used policy based routing in the past to direct traffic
that needs to be NATd from a switch to a router but it was as little
simpler in that the router's outgoing NAT address was just a normal
sub-interface and not a loopback.
Thanks for any help.
jeff
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
