Easy Cisco NAT Pools and VRF’s

I’ve been struggling to find a quick and dirty guide to use NAT Pool Overloads between two VRF’s. A lot of the guides I came across either had RDs, BGP or NATting into the global VRF table. All I wanted was to have Red talk to Blue by NATting the Red network to a NAT Pool which is routeable by Blue. In my scenario I would have an internet connection in a WWW VRF and my internal servers in a 10 VRF. I guess you could argue why to even use VRF’s in this case as there is no benefit in this specific example, but anyway. So here we go.

Build our VRF

ip vrf 10
ip vrf WWW

Configure the interfaces with IP’s in the right VRF

interface FastEthernet0/0
description Internet
ip vrf forwarding WWW
ip address
ip nat enable
duplex auto
speed auto

interface FastEthernet1/0
description Servers
ip vrf forwarding 10
ip address
ip nat enable
duplex auto
speed auto

Add a default route into the 10 VRF, exiting the Fa0/0 interface which will mark it in the WWW VRF and aim for a next hop of

ip route vrf 10 FastEthernet0/0

Allow our host to use the NAT Pool.

ip access-list extended NAT
permit ip any

Make sure to specify the add-route to the back of your NAT Pool, otherwise when the return traffic comes back it will be dropped as there is no subnet in the WWW VRF.

ip nat pool Global netmask add-route

Overload your NAT Pool in the 10 VRF.

ip nat source list NAT pool Global vrf 10 overload



NOTE: This only works in IOS, not IOS XE

Leave a Reply

Your email address will not be published. Required fields are marked *