Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a Cisco 1921 with two VRF's: one to the internet and one to the LAN. The LAN is in private address space so source address translation needs to happen when the packets leave the internet interface. Here is my configuration:

! Last configuration change at 12:39:05 UTC Wed Jun 19 2013
version 15.3
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Internet
 rd 65000:1
 route-target export 65000:1
 route-target import 65000:2
 !
 address-family ipv4
 exit-address-family
!
vrf definition LAN
 rd 65000:2
 route-target export 65000:2
 route-target import 65000:1
 !
 address-family ipv4
 exit-address-family
!
!
no aaa new-model
!
ip cef
!
ip dhcp pool 10.0.0.0/24
 vrf LAN
 network 10.0.0.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 10.0.0.1
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
license udi pid CISCO1921/K9 sn censored
!
redundancy
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 vrf forwarding Internet
 ip address dhcp
 ip nat enable
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 vrf forwarding LAN
 ip address 10.0.0.1 255.255.255.0
 ip nat enable
 duplex auto
 speed auto
!
router bgp 65000
 bgp router-id 1.2.3.4
 bgp router-id vrf auto-assign
 bgp log-neighbor-changes
 !
 address-family ipv4 vrf Internet
  network 0.0.0.0
  default-information originate
 exit-address-family
 !
 address-family ipv4 vrf LAN
  network 10.0.0.0 mask 255.255.255.0
 exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat source list LAN interface GigabitEthernet0/0 vrf LAN overload
!
ip access-list extended LAN
 permit ip 10.0.0.0 0.0.0.255 any
!
control-plane
!
line con 0
 speed 115200
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 login
 transport input all
!
scheduler allocate 20000 1000
!
end

So we have two VRF's: * Internet, interface GigabitEthernet0/0 * LAN, interface GigabitEthernet0/1

Between the LAN and Internet, NAT occurs when traffic gets routed to the internet.

I've used the "new" NAT method: NVI, instead of statically defining NAT inside/outside interfaces (as this is the way you're supposed to go according to Cisco - and the only way to do NAT between VRF's).

The problem is that the performance is abysmally low. A quick measurement test came up with a speed of 13,42 megabits per second.

When I try the same configuration without using NVI (classic ip nat inside/outside instead of ip nat enable), I get a result of 76,08 megabits per second, which is very close to our maximum internet speed here.

Note that the VRF's are not the problem, without VRF's the performance is at the same low, but you can't use ip nat inside/outside between VRF's.

I think it's pretty obvious this is a hardware limitation and all packets get process switched even though CEF is enabled when using such a construct. My question is - to rule out any configuration errors on my part - does anyone have the same results and is there a router platform that does not have this problem?

share|improve this question
    
If this is pretty much you're entire router config, do you really need VRF's here? It doesn't really look like it too me anyway. As you said you are likely process switching the traffic, that would be my guess for the poor performance. –  jwbensley Jun 19 '13 at 15:09
    
Yes, for this kind of setup, that's way overdone. But I've simplified the configuration to easily explain this problem, so yes I do need to use VRF's in the target setup I am going to. –  RedShift Jun 21 '13 at 6:18
    
@hestonk You are asking for trouble my friend :) I made the same helpful comment and to say thank you, it was removed and I received a written warning from the moderators, about not promoting other stack exchange sites, it's not allowed, even though this question clearly needs it. –  jwbensley Jun 24 '13 at 15:50
    
@javano yeah i actually started reading into on meta after i posted this.....i didn't realize it was a violation. I don't think its letting me delete my comment. Was just trying to get this guy some answers! –  knotseh Jun 24 '13 at 20:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.