NAT over MPLS VPN

Step 1: config MPLS VPN
 - network: 10.1.xy.0/24
 - loopback address: x.x.x.0/24
 - R2, R3, R4 core MPLS. running ospf are 0.
 - R2 and R4 establish M-BGP
Step 2: config nat on R4.
R4#
interface Loopback1
 ip vrf forwarding VPN
 ip address 44.44.44.44 255.255.255.0
 ip nat outside
 ip virtual-reassembly
!
interface FastEthernet0/0
 ip vrf forwarding VPN
 ip address 192.168.45.4 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 10.1.34.4 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 ip ospf 1 area 0
 mpls ip
!
ip route vrf VPN 5.5.5.5 255.255.255.255 FastEthernet0/0 192.168.45.5
!
ip nat inside source list 1 interface Loopback1 vrf VPN overload
!
access-list 1 permit 5.5.5.5
-------------------------------------------------------------------------------------------
R5# 
interface FastEthernet0/0
 ip address 192.168.45.5 255.255.255.0
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 10.1.45.4

Step 3: verify
R5#ping 1.1.1.1 so l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/46/84

R4#debug ip nat
Mar  1 00:38:42.427: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [70]
*Mar  1 00:38:42.507: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [70]
*Mar  1 00:38:42.535: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [71]
*Mar  1 00:38:42.559: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [71]
*Mar  1 00:38:42.575: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [72]
*Mar  1 00:38:42.583: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [72]
*Mar  1 00:38:42.603: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [73]
*Mar  1 00:38:42.631: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [73]
*Mar  1 00:38:42.655: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [74]
*Mar  1 00:38:42.667: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [74]
R4#show ip nat translations vrf VPN
Pro Inside global      Inside local       Outside local      Outside global
icmp 44.44.44.44:14    5.5.5.5:14         1.1.1.1:14         1.1.1.1:14

IRDP

Su dung giao thuc ICMP de quang ba dia chi default-gateway vao trong mang LAN

R1 interface FastEthernet0/0  ip address 10.1.123.1 255.255.255.0  ip irdp  ip irdp address 10.1.123.254 100

R2 interface FastEthernet0/0  ip address 10.1.123.2 255.255.255.0  ip irdp  ip irdp address 10.1.123.253 101

R3 interface FastEthernet0/0  ip address 10.1.123.3 255.255.255.0  no ip route-cache  ! no ip routing ! ip gdp irdp

DHCP Proxy

DHCP Proxy is an address allocation solution for PPP. When a client requests an IP address via IPCP, the server may issue a DHCP request (act as a proxy) using its own IP address on the PPP interface as the “giaddr” field.

R1 ip dhcp pool DHCP    network 10.1.23.0 255.255.255.0

R2 interface Serial1/0  ip address 10.1.23.2 255.255.255.0  encapsulation ppp  peer default ip address dhcp  serial restart-delay 0 ! ip dhcp-server 10.1.12.1 ip address-pool dhcp-proxy-client

R3 interface Serial1/0  ip address negotiated  encapsulation ppp  no peer neighbor-route  serial restart-delay 0  !

DHCP on-deman pool

ODAP allows importing DHCP settings using various methods, one of them being IPCP (Internet Protocol Control Protocol for PPP). IPCP allows importing an IP address along with the subnet mask (while PPP ignores the mask, DHCP can use it) as well as DNS/WINS servers. This is useful in PPPoE deployments,

such as with DSL, where the DSL CPE router gets an address assignmentthrough DHCP from the provider, and forwards options such as DNS to the clients behind the CPE.To verify this check the DHCP pool settings and verify the imported parameters

R2 - R3 encapsulation PPP. Config f0/0 R3 nhan dia chi ipaddress tu R2.

R2: interface Serial1/0  ip address 10.1.23.2 255.255.255.0  encapsulation ppp  no peer neighbor-route  peer default ip address 10.1.23.3  ppp ipcp mask 255.255.255.0

R3: interface Serial1/0  ip address negotiated  encapsulation ppp  no peer neighbor-route  ppp ipcp mask request

When R3 receives RIP updates from R2 they are discarded because they are on different networks. This is due to the fact that R3 uses the host route 10.1.23.3/32, and R2 is outside this range. To resolve this R3 must disable the update source validation feature. Additionally the peer-neighbor-route feature is disabled so that R3 does not inject R2’s IP address as a host route into the routing domain.

Hoac

R3#show run | se router rip

router rip

 version 2

 no validate-update-source

 network 0.0.0.0

 no auto-summary

DHCP Host Pool

Cau hinh DHCP server R1:

ip dhcp pool DHCP

   network 10.1.12.0 255.255.255.0

!

De gan dia chi interface 0/0 R2 la 10.1.12.5 thuc hien nhu sau.

R2#show int f0/0

FastEthernet0/0 is up, line protocol is up

  Hardware is i82543 (Livengood), address is ca01.1018.0008 (bia ca01.1018.0008)

ca01.1018.0008 chuyen dia chi mac dinh dang cisco. Them bit 01 vao phia truoc 01ca.0110.1800.08

Tren R1 cau hinh pool DHCP_R2

R1:

ip dhcp pool DHCP_R2

   host 10.1.12.5 255.255.255.0                      //cap host dia chi nay qua DHCP voi clent-id co mac 01ca.0110.1800.08

   client-identifier 01ca.0110.1800.08

!

R2:

interface FastEthernet0/0

 ip address dhcp client-id FastEthernet0/0

 !

End

Debug dhcp detail

Sep  4 14:43:39.303: DHCP: Received a BOOTREP pkt

*Sep  4 14:43:39.303: DHCP: offer received from 10.1.12.1

*Sep  4 14:43:39.303: DHCP: SRequest attempt # 1 for entry:

*Sep  4 14:43:39.303: DHCP: SRequest- Server ID option: 10.1.12.1

*Sep  4 14:43:39.303: DHCP: SRequest- Requested IP addr option: 10.1.12.5

*Sep  4 14:43:39.307: DHCP: SRequest: 283 bytes

*Sep  4 14:43:39.307: DHCP: SRequest: 283 bytes

*Sep  4 14:43:39.307:             B'cast on FastEthernet0/0 interface from 0.0.0.0

*Sep  4 14:43:39.439: DHCP: Received a BOOTREP pkt

R2#

*Sep  4 14:43:41.187: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Sep  4 14:43:42.187: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

*Sep  4 14:43:42.471: DHCP: Sending notification of ASSIGNMENT:

*Sep  4 14:43:42.471:   Address 10.1.12.5 mask 255.255.255.0

*Sep  4 14:43:42.475: DHCP Client Pooling: ***Allocated IP address: 10.1.12.5

*Sep  4 14:43:42.491: Allocated IP address = 10.1.12.5  255.255.255.0

R2#

*Sep  4 14:43:42.491: %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 assigned DHCP address 10.1.12.5, mask 255.255.255.0, hostname R2

DHCP configure

Config DHCP server:

#ip dhcp excluded-address 155.1.146.100 155.1.146.254

#ip dhcp pool DHCP

   #network 155.1.146.0 255.255.255.0

   #default-router 155.1.146.4 155.1.146.6                                     //config 2 default-gateway for redurancy

   #dns-server 155.1.146.4 155.1.146.6

   #lease 0 12

Note: khi cau hinh DHCP, nen cau hinh dhcp exclude truoc dhcp pool, neu khong dai ip trong exclude van se duoc su dung, neu co client nao do request som hon khi exclude apply.

Khi su dung access-list: chu y permit UPD host 0.0.0.0 {ip server} nhăm tranh filter các gói tin discover

And ack

Config DHCP client:

#interface Ethernet0/0

  #ip address dhcp client-id Ethernet0/0

Debug dhcp deital:

• Gui goi tin DHCP discover tu client, voi source ip add 0.0.0.0 , mac interface e0/0.

DHCP: DHCP client process started: 10

RAC: Starting DHCP discover on Ethernet0/0

DHCP: Try 1 to acquire address for Ethernet0/0

DHCP: allocate request

DHCP: new entry. add to queue, interface Ethernet0/0

DHCP: Client socket is opened

DHCP: SDiscover attempt # 1 for entry:

Temp IP addr: 0.0.0.0  for peer on Interface: Ethernet0/0

Temp  sub net mask: 0.0.0.0

   DHCP Lease server: 0.0.0.0, state: 3 Selecting

   DHCP transaction id: 131F

   Lease: 0 secs,  Renewal: 0 secs,  Rebind: 0 secs

   Next timer fires after: 00:00:04

   Retry count: 1   Client-ID: aabb.cc00.0100

   Client-ID hex dump: AABBCC000100

   Hostname: Rack1R1

DHCP: SDiscover: sending 276 byte length DHCP packet

DHCP: SDiscover 276 bytes

            B'cast on Ethernet0/0 interface from 0.0.0.0

• Server gui goi tin DHCP offer voi thong tin pool DHCP ma no co, voi soure 155.1.146.6 va dest 255.255.255.255

DHCP: Received a BOOTREP pkt

DHCP: Scan: Message type: DHCP Offer

DHCP: Scan: Server ID Option: 155.1.146.6 = 9B019206

DHCP: Scan: Lease Time: 43200

DHCP: Scan: Renewal time: 21600

DHCP: Scan: Rebind time: 37800

DHCP: Scan: Subnet Address Option: 255.255.255.0

DHCP: Scan: Router Option: 155.1.146.4, 155.1.146.6

DHCP: Scan: DNS Name Server Option: 155.1.146.4, 155.1.146.6

DHCP: rcvd pkt source: 155.1.146.6,  destination:  255.255.255.255

   UDP  sport: 43,  dport: 44,  length: 308

   DHCP op: 2, htype: 1, hlen: 6, hops: 0

   DHCP server identifier: 155.1.146.6

        xid: 131F, secs: 0, flags: 8000

        client: 0.0.0.0, your: 155.1.146.3

        srvr:   0.0.0.0, gw: 0.0.0.0

        options block length: 60

DHCP Offer Message   Offered Address: 155.1.146.3

DHCP: Lease Seconds: 43200    Renewal secs:  21600    Rebind secs:   37800

DHCP: Server ID Option: 155.1.146.6

DHCP: offer received from 155.1.146.6

• Client gui goi tin request yeu cau cap dia chi ip toi server ma no duoc offer, voi source

DHCP: SRequest attempt # 1 for entry:

Temp IP addr: 155.1.146.3  for peer on Interface: Ethernet0/0

Temp  sub net mask: 255.255.255.0

   DHCP Lease server: 155.1.146.6, state: 4 Requesting

   DHCP transaction id: 131F

   Lease: 43200 secs,  Renewal: 0 secs,  Rebind: 0 secs

   Next timer fires after: 00:00:03

   Retry count: 1   Client-ID: aabb.cc00.0100

   Client-ID hex dump: AABBCC000100

   Hostname: Rack1R1

DHCP: SRequest- Server ID option: 155.1.146.6

DHCP: SRequest- Requested IP addr option: 155.1.146.3

DHCP: SRequest: 288 bytes

DHCP: SRequest: 288 bytes

            B'cast on Ethernet0/0 interface from 0.0.0.0

DHCP: Received a BOOTREP pkt

DHCP: Scan: Message type: DHCP Ack

DHCP: Scan: Server ID Option: 155.1.146.6 = 9B019206

DHCP: Scan: Lease Time: 43200

DHCP: Scan: Renewal time: 21600

DHCP: Scan: Rebind time: 37800

DHCP: Scan: Subnet Address Option: 255.255.255.0

DHCP: Scan: Router Option: 155.1.146.4, 155.1.146.6

DHCP: Scan: DNS Name Server Option: 155.1.146.4, 155.1.146.6

DHCP: rcvd pkt source: 155.1.146.6,  destination:  255.255.255.255

   UDP  sport: 43,  dport: 44,  length: 308

   DHCP op: 2, htype: 1, hlen: 6, hops: 0

   DHCP server identifier: 155.1.146.6

        xid: 131F, secs: 0, flags: 8000

        client: 0.0.0.0, your: 155.1.146.3

        srvr:   0.0.0.0, gw: 0.0.0.0

        options block length: 60

• Client nhan ACK tu server, qua trinh nhan dia chi ip tu DHCP hoan thanh.

DHCP Ack Message

DHCP: Lease Seconds: 43200    Renewal secs:  21600    Rebind secs:   37800

DHCP: Server ID Option: 155.1.146.6

DHCP: Releasing ipl options:

DHCP: Applying DHCP options:

  Setting default_gateway to 155.1.146.4

  Adding default route 155.1.146.4

  Adding DNS server address 155.1.146.4

  Adding DNS server address 155.1.146.6

DHCP: Sending notification of ASSIGNMENT:

  Address 155.1.146.3 mask 255.255.255.0

DHCP Client Pooling: ***Allocated IP address: 155.1.146.3

Allocated IP address = 155.1.146.3  255.255.255.0

%DHCP-6-ADDRESS_ASSIGN: Interface Ethernet0/0 assigned DHCP address 155.1.146.3, mask 255.255.255.0, hostname Rack1R1

Neu muon e0/0 nhan dhcp voi IP 155.1.146.1

Tren R6 ta config nhu sau: