You do not have to use NVI. We require the VASI functionality, so if we run out.. then we will have to buy more ASRs.
Each customer has their own VRF and there are between 1 and 4 VRFs they are all converging on. Its all VRF lite for us, so the VASI interfaces are always outside NAT interfaces, and the customer-facing and services-facing interfaces are inside (providing us overload in both directions). Not every customer talks to all 3 or 4 of the service area VRFs. So its up in the air as to how many customers will be supported with 500 pairs. In your case, you have one service area: the mgmt VRF. So you could support about 500 customers potentially on one ASR using VASI. Also keep in mind that the NAT sessions themselves are not stored in main memory, but a much smaller high-speed memory area. The 20G ESP supports 512k sessions globally, the 10G supports 256k and below that is 128k I believe... ________________________________ From: Matthew Melbourne <[email protected]> To: Derick Winkworth <[email protected]>; Neil Fenemor <[email protected]> Cc: [email protected] Sent: Sat, August 7, 2010 10:22:07 AM Subject: RE: [c-nsp] VRF-Aware NAT in ASR1k So, are you doing something like: interface vasileft1 vrf forwarding MGMT ... interface vasiright1 vrf forwarding CUST-1 ... interface vasileft2 vrf forwarding MGMT ... interface vasiright2 vrf forwarding CUST-2 ... Do you have to perform NAT using NVI between VRFs. The limitation here may be that ~500 pairs may not be enough. The only other option I can see is to NAT the hosts within the Customer VRFs into the global table and provide some upstream firewalling for external connectivity? Cheers, Matt ________________________________________ From: Derick Winkworth [mailto:[email protected]] Sent: 07 August 2010 15:53 To: Matthew Melbourne; Neil Fenemor Cc: [email protected] Subject: Re: [c-nsp] VRF-Aware NAT in ASR1k I believe the limit is 500 *pairs* of interfaces... We are using the ASR too for this exact thing. ________________________________________ From: Matthew Melbourne <[email protected]> To: Neil Fenemor <[email protected]> Cc: [email protected] Sent: Sat, August 7, 2010 9:04:37 AM Subject: Re: [c-nsp] VRF-Aware NAT in ASR1k Yes, I saw VASI Enhancements Phase I in the latest ASR 3.1S release notes. There is a limit of 500 VASI interfaces which may be an issue for multiple customer VRFs. Basically, the requirement is to NAT hosts within hosted customer private networks (VRFs) to another private range which makes them available and routable from our management systems, and additionally provides limited Internet access to update servers, etc. -----Original Message----- From: Neil Fenemor [mailto:[email protected]] Sent: 07 August 2010 02:55 To: Matthew Melbourne Subject: Re: [c-nsp] VRF-Aware NAT in ASR1k Hi Matthew, Have you looked at VASI at all? It's a reasonably recent addition to the ASR1k codebase, but does some interesting things. Cheers, neil On 6/08/2010, at 8:52 PM, Matthew Melbourne wrote: > Hi, > > Is it possible to implement VRF-Aware NAT on the ASR1k, specifically > NAT between two different VRFs? Ideally, I have a requirement to NAT > between customers' VRFs and a management VRF and from customers' VRFs > to the global table (for limited Internet access). > > Cheers, > > Matt > > -- > Matthew Melbourne > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ -- Neil Fenemor Señor Network Engineer FX Networks (m) 021 978 078 (e) [email protected] (w) http://www.fx.net.nz/ (p) 04 498 9565 (f) 04 498 9649 Level 3 FX Networks House 138 The Terrace Wellington No virus found in this incoming message. Checked by AVG - www.avg.com Version: 9.0.851 / Virus Database: 271.1.1/3056 - Release Date: 08/07/10 07:28:00 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ No virus found in this incoming message. Checked by AVG - www.avg.com Version: 9.0.851 / Virus Database: 271.1.1/3056 - Release Date: 08/07/10 07:28:00 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
