Aviatrix ActiveMesh with Customized SNAT and DNAT on Spoke Gateway
The Problem
Organizations usually plan out cloud network address ranges for building non-overlapping connectivity to on-prem, but there are times where a cloud network CIDR conflicts with an on-prem network address range. Moreover, there might be a constraint that neither source NAT nor destination NAT can be performed in the on-prem network but still requires connectivity to on-prem. Therefore, how to fulfill source NAT and destination NAT in the cloud becomes a key solution.
Aviatrix Solution
This document illustrates an example solution of performing source NAT and destination NAT feature on Aviatrix spoke gateway to a specific use case where a customer needs a connectivity between certain on-prem hosts and certain cloud instances, but the on-prem network range overlaps with the cloud network CIDR as shown in the diagram below. Additionally, traffic can be initiated from either side.
Topology - Aviatrix Global Transit HA Network with Active Mesh:
![Transit-ActiveMesh-Spoke](_images/topology.png)
In this example, the on-prem network address range is 10.3.0.0/16 and all other spoke VPCs connect to on-prem via Aviatrix Global Transit HA Network with Active Mesh, however there is one spoke VPC with an identical CIDR of 10.3.0.0/16.
This example supports:
|
Furthermore, this document provides a step-by-step configuration on the Aviatrix controller that will address the following requirements:
-
Deploy virtual CIDR within RFC 1918 range to solve the overlapping CIDR between on-prem network and cloud network
Scenario:
-
Traffic which is initiated from on-prem to cloud spoke network sends to a virtual IP of cloud instance. In addition, cloud instance views a virtual IP of on-prem host.
-
Traffic which is initiated from cloud spoke network to on-prem sends to a virtual IP of on-prem host. In addition, on-prem views a virtual IP of cloud instance.
-
All virtual IPs belong to the RFC 1918 range.
Follow the steps below to set up for the scenario.
Prerequisites
-
Upgrade the Aviatrix Controller to the latest version.
-
Prepare a Real/Virtual CIDR mapping table for on-prem network and cloud network
One of the key steps to solve overlapping network issues is to route a non-overlapping CIDR. Therefore, please prepare a virtual route table CIDR for your on-prem and spoke network. In this example, a Virtual CIDR within the RFC 1918 range is created.
Real/Virtual CIDR mapping table example: ============== ============== ================ Real CIDR Virtual CIDR ============== ============== ================ Spoke VPC 10.3.0.0/16 10.203.0.0/16 On-Prem VPC 10.3.0.0/16 10.103.0.0/16 ============== ============== ================
-
Find out the Real IPs of certain on-prem hosts and certain cloud instances to build a Real/Virtual IPs mapping table
Since this solution is to tackle a specific use case where a customer needs a connectivity between certain on-prem hosts and certain cloud instances in overlapping CIDR, please find out those IPs and plan a Real/Virtual IPs mapping table for routing advertisement and NAT configuration.
Real/Virtual IPs mapping table example: ================ ============== ================ Real IP Virtual IP ================ ============== ================ Cloud instance 10.3.0.86/32 10.203.0.86/32 On-Prem host 10.3.0.85/32 10.103.0.85/32 ================ ============== ================
Build Aviatrix Global Transit HA Network with Active Mesh
Deploy the topology by following steps 1, 2, 3, 4, and 5 in Multicloud Network Transit Workflow.
-
Make sure HA is deployed for both Aviatrix Transit Gateway and Spoke Gateway
-
Make sure on-prem router advertises only the Real IP with /32 of on-prem host not the whole Real CIDR or Virtual IP/CIDR
Example: on-prem router advertises 10.3.0.85/32 which is the Real IP of On-prem host
Perform Customize Spoke Advertised VPC CIDRs feature on Aviatrix Spoke gateway
This action is to advertise the Virtual CIDR of cloud spoke network to on-prem via BGP session so that on-prem is able to route the Virtual IP of Cloud instance. Please refer to Customizing Spoke Advertised VPC CIDRs.
To configure:
-
Go to the Gateway page, click on the Aviatrix Spoke Gateway first.
-
Click Edit.
-
Continue on to the Edit page, scroll to Customize Spoke Advertised VPC CIDRs.
-
Enter the Virtual CIDR of cloud spoke VPC that on-prem is able to route. Make sure to advertise the Virtual CIDR of cloud spoke VPC, not the Virtual IP of specific cloud instance.
-
Click Save.
![TRANSIT_ACTIVEMESH_SPOKE_CUSTOMIZED_SPOKE_ADVERTISE_VPC_CIDR](_images/spoke-customized-advertise-vpc-cidr.png)
Example: Aviatrix Spoke gateway advertises 10.203.0.0/16 which is the Virtual CIDR of cloud spoke VPC
Attach Aviatrix Spoke to Aviatrix Transit Network
Follow the Join a Spoke GW to Transit GW Group in Global Transit Network Workflow.
Configure Aviatrix DNAT function on Aviatrix Spoke Gateway for the traffic which is initiated from on-prem to Cloud Spoke Network
This action instructs the Spoke gateway to translate a destination address from a Virtual IP of cloud instance to a Real IP of cloud instance in cloud spoke VPC. Please refer to the Aviatrix DNAT function document.
To configure:
-
Go to the Gateway page and click on the Spoke Primary Gateway.
-
Click Edit.
-
Scroll down to “Destination NAT".
-
Click Add/Edit DNAT.
-
Click Add New.
-
Enter fields for Src CIDR, Dst CIDR, Protocol, Connection, Mark, DNAT IPs and Exclude Route Table as per the below example.
Field | Value |
---|---|
Source CIDR |
Real IP of on-prem host (i.e. 10.3.0.85/32) |
Source Port |
Leave it blank |
Destination CIDR |
Virtual IP of cloud instance (i.e. 10.203.0.86/32) |
Destination Port |
Leave it blank |
Protocol |
all |
Interface |
eth0 |
Connection |
Select the connection to Transit Gateway |
Mark |
A rule field to mark this traffic session (i.e. use 103085 to track source 10.3.0.85/32) |
DNAT IPs |
Real IP of cloud instance (i.e. 10.3.0.86) |
DNAT Port |
Leave it blank |
Exclude Route Table |
[IMPORTANT] Collect all your cloud routing table ids and fill them here |
![DNAT_SPOKE_ONPREM_TO_CLOUD](_images/dnat-spoke-onprem-cloud.png)
-
Click Save.
-
Repeat steps 4, 5, 6 for multiple entries.
-
Click Update to commit.
Configure Aviatrix Customized SNAT function on Aviatrix Spoke Gateway and Spoke HA Gateway for the traffic which is initiated from on-prem to cloud spoke network
This action changes the packet’s source IP address from a Real IP of on-prem host to a Virtual IP representing on-prem host. Please refer to Aviatrix Customized SNAT.
To configure:
-
Go to the Gateway page, click on the Spoke Primary Gateway first.
-
Click Edit.
-
Continue on to the Edit page, scroll to SNAT.
-
Select Customized SNAT.
-
Click Add New.
-
Enter fields for Protocol, Interface, Mark, SNAT IPs, and Exclude Route Table as per the below example.
Field | Value |
---|---|
Source CIDR |
Leave it blank |
Source Port |
Leave it blank |
Destination CIDR |
Leave it blank |
Destination Port |
Leave it blank |
Protocol |
all |
Interface |
eth0 |
Connection |
Select None |
Mark |
Fill the number that we configure in the previous DNAT step 5 (i.e. 103085) |
SNAT IPs |
Virtual IP of on-prem host (i.e. 10.103.0.85) |
SNAT Port |
Leave it blank |
Exclude Route Table |
[IMPORTANT] Collect all your cloud routing table ids and fill them here |
-
Click Save.
-
Repeat the above steps for more entries.
-
Click Enable SNAT to commit.
![SNAT_SPOKE_PRIMARY_ONPREM_TO_CLOUD](_images/snat-spoke-primary-onprem-cloud.png)
-
Go to Gateway page, click on the Spoke HA Gateway. Click Edit.
-
Repeat the above steps to configure Customized SNAT for Spoke HA Gateway as shown in the example below.
![SNAT_SPOKE_HA_ONPREM_TO_CLOUD](_images/snat-spoke-ha-onprem-cloud.png)
-
Configure Aviatrix DNAT function on Aviatrix Spoke Gateway for the traffic which is initiated from cloud spoke network to on-prem.
Configure Aviatrix DNAT function on Aviatrix Spoke Gateway for the traffic which is initiated from cloud spoke network to on-prem
This action instructs the spoke gateway to translate a destination address from a Virtual IP of on-prem host to a Real IP of on-prem host. Please refer to the Aviatrix DNAT function document.
To configure:
-
Go to the Gateway page and click on the Spoke Primary Gateway.
-
Click Edit.
-
Scroll down to “Destination NAT".
-
Click Add/Edit DNAT.
-
Click Add New.
-
Enter fields for Src CIDR, Dst CIDR, Protocol, Interface, Mark, DNAT IPs and Exclude Route Table as per the below example.
Field | Value |
---|---|
Source CIDR |
Real IP of cloud instance (i.e. 10.3.0.86/32) |
Source Port |
Leave it blank |
Destination CIDR |
Virtual IP of on-prem host (i.e. 10.103.0.85/32) |
Destination Port |
Leave it blank |
Protocol |
all |
Interface |
eth0 |
Connection |
Select None |
Mark |
A rule field to mark this traffic session (i.e. use 103086 to track source 10.3.0.86/32) |
DNAT IPs |
Real IP of on-prem host (i.e. 10.3.0.85/32) |
DNAT Port |
Leave it blank |
Exclude Route Table |
[IMPORTANT] Collect all your cloud routing table ids and fill them here |
![DNAT_SPOKE_CLOUD_TO_ONPREM](_images/dnat-spoke-cloud-onprem.png)
-
Click Save.
-
Repeat steps 4, 5, and 6 for multiple entries.
-
Click Update to commit.
Configure Aviatrix Customized SNAT function on Aviatrix Spoke
Gateway and Spoke HA Gateway for the traffic which is initiated from cloud spoke network to on-prem.
This action changes the packet’s source IP address from a Real IP of cloud instance to a Virtual IP representing cloud instance. Please refer to Aviatrix Customized SNAT.
To configure:
-
Go to the Gateway page, click on the Spoke Primary Gateway first.
-
Click Edit.
-
Continue on to the Edit page, scroll to SNAT. Select Customized SNAT.
-
Select Customized SNAT.
-
Click Add New.
-
Enter fields for Protocol, Interface, Connection, Mark, SNAT IPs, and Exclude Route Table as per the below example.
Field | Value |
---|---|
Source CIDR |
Leave it blank |
Source Port |
Leave it blank |
Destination CIDR |
Leave it blank |
Destination Port |
Leave it blank |
Protocol |
all |
Interface |
eth0 |
Connection |
Select the connection to Transit Gateway |
Mark |
Fill the number that we configure in the previous DNAT step 7 (i.e. 103086) |
SNAT IPs |
Virtual IP of cloud instance (i.e. 10.203.0.86) |
SNAT Port |
Leave it blank |
Exclude Route Table |
[IMPORTANT] Collect all your cloud routing table ids and fill them here |
-
Click Save.
-
Repeat the above steps for more entries.
-
Click Enable SNAT to commit.
![SNAT_SPOKE_PRIMARY_CLOUD_TO_ONPREM](_images/snat-spoke-primary-cloud-onprem.png)
-
Go to Gateway page, click on the Spoke HA Gateway. Click Edit.
-
Repeat the above steps to configure Customized SNAT for Spoke HA Gateway as shown in the example below.
![SNAT_SPOKE_HA_CLOUD_TO_ONPREM](_images/snat-spoke-ha-cloud-onprem.png)
Verify Traffic Flow
Traffic from on-prem to cloud spoke network
-
Issue ICMP traffic from on-prem host to a Virtual IP of cloud instance
![ONPREM_HOST_TO_CLOUD_INSTANCE](_images/onprem-host-cloud-instance.png)
-
Execute packet capture on the cloud instance
Traffic from cloud spoke network to on-prem
-
Issue ICMP traffic from cloud instance to a Virtual IP of on-prem
![CLOUD_INSTANCE_TO_ONPREM_HOST](_images/cloud-instance-onprem-host.png)
-
Execute packet capture on the on-prem host
![ONPREM_HOST_PACKET_CAPTURE](_images/onprem-host-packet-capture.png)
FAQ
Q1: Why we need to “mark" the NAT sessions?
Ans: Basically, "mark" function in NAT is a unique number that is associated with specific packets. In this tech note, we leverage on it for the purpose of tracking session identified by the Source CIDR of DNAT and then utilizing it for the SNAT IPs of customized SNAT. It is an advanced option for users to configure NAT rule. Alternatively, users still can configure DNAT and customized SNAT rule without mark.
Q2: Why we need to fill all VPC route table IDs for “Exclude Route Table"?
Ans: As Aviatrix Global Transit HA Network design has a mechanism to handle cloud routing table updates, filling all VPC route table IDs for “Exclude Route Table" in NAT feature prevents extra routes to be injected in cloud routing table.