I'm setting up a Cisco 1921 with two VRF's: one to the internet and one to the LAN. The LAN is in private address space so source address translation needs to happen when the packets leave the internet interface. Here is my configuration:
! Last configuration change at 12:39:05 UTC Wed Jun 19 2013 version 15.3 service config service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! vrf definition Internet rd 65000:1 route-target export 65000:1 route-target import 65000:2 ! address-family ipv4 exit-address-family ! vrf definition LAN rd 65000:2 route-target export 65000:2 route-target import 65000:1 ! address-family ipv4 exit-address-family ! ! no aaa new-model ! ip cef ! ip dhcp pool 10.0.0.0/24 vrf LAN network 10.0.0.0 255.255.255.0 dns-server 18.104.22.168 default-router 10.0.0.1 ! no ipv6 cef ! multilink bundle-name authenticated ! ! license udi pid CISCO1921/K9 sn censored ! redundancy ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 vrf forwarding Internet ip address dhcp ip nat enable duplex auto speed auto ! interface GigabitEthernet0/1 vrf forwarding LAN ip address 10.0.0.1 255.255.255.0 ip nat enable duplex auto speed auto ! router bgp 65000 bgp router-id 22.214.171.124 bgp router-id vrf auto-assign bgp log-neighbor-changes ! address-family ipv4 vrf Internet network 0.0.0.0 default-information originate exit-address-family ! address-family ipv4 vrf LAN network 10.0.0.0 mask 255.255.255.0 exit-address-family ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat source list LAN interface GigabitEthernet0/0 vrf LAN overload ! ip access-list extended LAN permit ip 10.0.0.0 0.0.0.255 any ! control-plane ! line con 0 speed 115200 line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 login transport input all ! scheduler allocate 20000 1000 ! end
So we have two VRF's: * Internet, interface GigabitEthernet0/0 * LAN, interface GigabitEthernet0/1
Between the LAN and Internet, NAT occurs when traffic gets routed to the internet.
I've used the "new" NAT method: NVI, instead of statically defining NAT inside/outside interfaces (as this is the way you're supposed to go according to Cisco - and the only way to do NAT between VRF's).
The problem is that the performance is abysmally low. A quick measurement test came up with a speed of 13,42 megabits per second.
When I try the same configuration without using NVI (classic ip nat inside/outside instead of ip nat enable), I get a result of 76,08 megabits per second, which is very close to our maximum internet speed here.
Note that the VRF's are not the problem, without VRF's the performance is at the same low, but you can't use ip nat inside/outside between VRF's.
I think it's pretty obvious this is a hardware limitation and all packets get process switched even though CEF is enabled when using such a construct. My question is - to rule out any configuration errors on my part - does anyone have the same results and is there a router platform that does not have this problem?