Cisco SD-WAN NAT - PART II - Port Forwarding

written by: Ehsan Emad

In this article, I want to discuss the SD-WAN NAT feature.

A vEdge cloud router can play a NAT role. it can do the natting both on the transport side (VPN 0) and in the service side (VPN 1 for example).

If we deploy NAT in the transport side, NAT functionality allows traffic from the localhost to move directly to the Internet. We can do port forwarding.

The NAT software performs both address and port translation.

Cisco SD-WAN nat software supports 64,000 nat flows.

In this scenario, I want to do "PORT FORWARDING" on the transport side.

To achieve this goal, we need to do three critical steps.

  • Enable NAT on an interface that faces public Internet in VPN 0 (in our scenario its ge0/1).

  • Configure port forwarding.

  • Direct traffic from service VPN like VPN 1 to go to the Internet (public) so we need to have a route to VPN 0.

In the last step, we need to do verification in vmanage.

sd-wan

Let’s do configuration

In my scenario, I am using vManage to do the configuration for Paris Site.

First, we go to "templates" menu.

sd-wan-template

The first step is to enable NAT on VPN0.

sd-wan-transport-vpn0

Under Interface, we configure the NAT feature.

The second step is to configure "PORT FORWARDING" under Interface facing the public Internet.

Note: If you want to configure NAT port, then you must use STATIC NAT.

static-pat-vpn

static-pat-vpn

And here is the configuration for port forwarding.

static-pat-port-forwarding-configure

Let's do the third and final step.

In this step, we have to add a route in service side to VPN 0.

sd-wan-step3

For this goal, first, we go to VPN 1(in our scenario service VPN is 1) template:

sd-wan-route

Note: Remember to choose interesting traffic for NAT.

Verification

Now try to establish a TELNET session from Internet (simulated 8.8.8.8) to public IP of our vEdge IP address (10.50.70.100).

verify-static-pat

verify-static-pat

For vManage verification follow the steps:

sd-wan-verification-vmanage

sd-wan-vmanage-filter-

verification-static-pat

I hope you enjoy the article.

To be continued...

1138
0
0
Leave your comment