Embedded Files
LSN: Large Scale NAT
Large scale NAT was previously known by different terms like NAT444 and Carrier Grade NAT (CGN). It is dicussed in depth by Jeff Doyle. LSN stems from the fact that NAT is applied at the provider-facing customer edge and customer-facing provider edge. NAT is applied twice- once at the Customer CPE and second time at the Provider router.
The Service Provider assigns an address out of Private IPv4 block (RFC 1918 addresses) to the customer side of each LSN. The provider facing side is assigned a Public IPv4 address to each LSN. Each customer uses another Private IPv4 block to address each device within the network.
So, if a device within the customer network wish to access the Internet, the CPE will perform the translation on the source IP address. This {inside Private IPv4 source IP address, port} mapping will be translated to {outside Private IPv4 address, port} mapping (aka NAT-Port Translation) at the CPE. At the LSN device, the {inside Private IPv4 address, port} mapping will be translated to another {outside Public IPv4 address, port} mapping.
NOTE: Each LSN can support multiple Customers. Only one Customer is attached to each LSN here for simplicity.
Network topology:
IP Address assignment and NAT44 on CPE routers:
Since inside and outside interfaces of the CPE routers are Private IPv4 addresses, care should be taken that these IP addresses do not overlap, otherwise, it could cause routing issues.
Hence, the CPE will use 192.168.1.0/24 block to address devices within the network. The Service Provider will use 10.0.0.0/8 block to assign addresses to the Customers. The interesting traffic to be NAT will be traffic with source address from 192.168.1.0/24 network.
CPE Configuration
CPE1 router:interface Fastethernet 0/0 description INSIDE Interface ip address 192.168.1.1 255.255.255.0 ip nat inside!interface Serial 0/0 description OUTSIDE Interface ip address 10.1.0.2 255.255.255.252 ip nat outside!ip access-list extended NAT_Eligible permit ip 192.168.1.0 0.0.0.255 any!ip nat inside source list NAT_Eligible interface Serial 0/0 overload!CPE2 router:interface Fastethernet 0/0 description INSIDE interface ip address 192.168.1.1 255.255.255.0 !! All CPEs can use same Private IPv4 block 192.168.1.0/24 within their network ip nat inside!interface Serial 0/0 description OUTSIDE interface ip address 10.2.0.2 255.255.255.252 ip nat outside!ip access-list extended NAT_Traffic permit ip 192.168.1.0 0.0.0.255 any!ip nat inside source list NAT_Traffic interface Serial 0/0 overload!IP Address assignment and NAT44 on LSN routers:
The customer-facing side of LSN is assigned a Private IPv4 address while the Internet-facing side is assigned a Public IPv4 address. Since Customer traffic is already NAT-ed once, the source address of the IP packet would have changed to the outside IPv4 address of the CPE device. So interesting traffic for LSN1 router will have source address from 10.1.0.0/30 network and interesting traffic for LSN2 router will have source address from 10.2.0.0/30 network.
LSN Configuration
LSN1 router:interface Loopback 0 ip address 1.1.1.1 255.255.255.255!interface Serial 0/0 description Connected to CPE1 ip address 10.1.0.1 255.255.255.252 ip nat inside!interface Serial 0/1 description Connected to Internet ip address 123.10.1.2 255.255.255.252 ip nat outside!ip access-list extended CPE1_Traffic permit ip 10.1.0.0 0.0.0.3 any!ip nat inside source list CPE1_Traffic interface Serial 0/1 overload!LSN2 router:interface Loopback 0 ip address 2.2.2.2 255.255.255.255!interface Serial 0/0 description Connected to CPE2 ip address 10.2.0.1 255.255.255.252 ip nat inside!interface Serial 0/1 description Connected to Internet ip address 123.20.1.2 255.255.255.252 ip nat outside!ip access-list extended CPE2_Traffic permit ip 10.2.0.0 0.0.0.3 any!ip nat inside source list CPE2_Traffic interface Serial 0/1 overload!Routing on CPE and LSN routers:
Within the Customer network, the customer devices point towards Default Gateway i.e. the CPE router. There is an eBGP connection between CPE and LSN routers. The LSN routers advertise only default-route to the CPEs.
OSPF runs within the SP Public network. There are iBGP sessions between LSNs and the Internet router.
CPE Routing
CPE1 router:router bgp 65101 neighbor 10.1.0.1 remote-as 100!CPE2 router:router bgp 65102 neighbor 10.2.0.1 remote-as 100!LSN Routing
LSN1 router:router bgp 100 neighbor 10.1.0.2 remote-as 65101 neighbor 10.1.0.2 default-originate neighbor 10.1.0.2 route-map Default_Only out neighbor 3.3.3.3 remote-as 100 !iBGP with Internet router neighbor 3.3.3.3 update-source Loopback 0 neighbor 2.2.2.2 remote-as 100 !iBGP with LSN2 router neighbor 2.2.2.2 update-source Loopback 0 redistribute connected!router ospf 1 network 1.1.1.1 0.0.0.0 area 0 network 123.10.1.0 0.0.0.3 area 0!access-list 10 permit 0.0.0.0 0.0.0.0!route-map Default_Only match ip address 10!LSN2 router:router bgp 100 neighbor 10.2.0.2 remote-as 65102 neighbor 10.2.0.2 default-originate neighbor 10.2.0.2 route-map Default_Only out neighbor 3.3.3.3 remote-as 100 neighbor 3.3.3.3 update-source Loopback 0 neighbor 1.1.1.1 remote-as 100 !iBGP with LSN1 router neighbor 1.1.1.1 update-source Loopback 0 redistribute connected!router ospf 1 network 2.2.2.2 0.0.0.0 area 0 network 123.20.1.0 0.0.0.3 area 0!access-list 10 permit 0.0.0.0 0.0.0.0!route-map Default_Only match ip address 10!Verification:
If a PING is made from within the CPE1 router to an IP address 4.2.2.2 in the Internet, the CPE router will first perform NAT on the source IP address.
NAT on CPE1
CPE1# debug ip natNAT: s=192.168.1.1->10.1.0.2, d=4.2.2.2 [10]NAT*: s=4.2.2.2, d=10.1.0.2->192.168.1.1 [10]NAT: s=192.168.1.1->10.1.0.2, d=4.2.2.2 [11]NAT*: s=4.2.2.2, d=10.1.0.2->192.168.1.1 [11]NAT: s=192.168.1.1->10.1.0.2, d=4.2.2.2 [12]NAT*: s=4.2.2.2, d=10.1.0.2->192.168.1.1 [12]NAT: s=192.168.1.1->10.1.0.2, d=4.2.2.2 [13]NAT*: s=4.2.2.2, d=10.1.0.2->192.168.1.1 [13]NAT: s=192.168.1.1->10.1.0.2, d=4.2.2.2 [14]NAT*: s=4.2.2.2, d=10.1.0.2->192.168.1.1 [14]CPE1# show ip nat translationsPro Inside global Inside local Outside local Outside globalicmp 10.1.0.2:2 192.168.1.1:2 4.2.2.2:2 4.2.2.2:2The LSN1 router performs a second NAT on this ICMP traffic. This time the source IP address of these IP packets is the already NAT-ed 10.2.0.1.
NAT on LSN1
!---- debug ip nat ------00:45:49.635: NAT*: s=10.1.0.2->123.10.1.2, d=4.2.2.2 [0]00:45:49.635: NAT*: s=4.2.2.2, d=123.10.1.2->10.1.0.2 [0]00:45:49.931: NAT*: s=10.1.0.2->123.10.1.2, d=4.2.2.2 [1]00:45:49.951: NAT*: s=4.2.2.2, d=123.10.1.2->10.1.0.2 [1]00:45:50.055: NAT*: s=10.1.0.2->123.10.1.2, d=4.2.2.2 [2]00:45:50.063: NAT*: s=4.2.2.2, d=123.10.1.2->10.1.0.2 [2]00:45:50.123: NAT*: s=10.1.0.2->123.10.1.2, d=4.2.2.2 [3]00:45:50.127: NAT*: s=4.2.2.2, d=123.10.1.2->10.1.0.2 [3]00:45:50.159: NAT*: s=10.1.0.2->123.10.1.2, d=4.2.2.2 [4]00:45:50.159: NAT*: s=4.2.2.2, d=123.10.1.2->10.1.0.2 [4]LSN1# show ip nat translations verbosePro Inside global Inside local Outside local Outside globalicmp 123.10.1.2:0 10.1.0.2:0 4.2.2.2:0 4.2.2.2:0 create 00:00:18, use 00:00:18 timeout:60000, left 00:00:41, Map-Id(In): 1, flags:extended, use_count: 0, entry-id: 1, lc_entries: 0Page updated
Google Sites
Report abuse