using NAT to "change subnets"

[mnaylor]

Hello community,

I have what I think is an odd use case for NAT but am curious if it would work.

We are readdressing our campus and have a series of vending devices with no way to change the static IPs. All of those devices need to "move" to another subnet.

All of our on-campus routing takes place within our core switches, with no way to do NAT there. Our PA is simply the GW of last resort out to the Internet.

Would it be possible to route traffic destined for this vending subnet to the PA and use NAT to mask the device IPs?

Let me know if I'm unclear...not quite sure if what I'm trying to describe is possible.

[mnaylor]

@Adrian_Jensen

We are running HPE 5406 at the core, which do not support VRF.

[Adrian_Jensen]

I don't know HPEs at all, but this says you implement VRFs as "vpn-instance" on HPE:

https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-c03529403

A VRF is Cisco terminology is just a separate L3 routing table shared among specific ports. You can do the same on the PA itself by creating a new routing table and linking interfaces (physical or VLAN) to it:

Network -> Virtual Routers

[TomYoung]

Hi @mnaylor ,

How far are the VMs from the vending devices?  Can they be put on the same VLAN?

Thanks,

Tom

[mnaylor]

They could be put on the same VLAN by changing the addresses of the server, but keep in mind I have no way to program the vending devices. So, as far as the devices are concerned, nothing can "change". They have to talk to the servers via the current server IPs and I have no way to change the device IPs.

[TomYoung]

Hi @mnaylor ,

You could add a secondary NIC to one of the VMs in the vending device subnet.  You can configure that VM to route.  You can add a route on the other VMs to point to the multi-homed VM.  Only a handful of VMs will have the route in your network.

If you don't want to go that route (pun intended), I recommend you keep the vending network connected to your internal network.  From what I understand, it seems unlikely that you will sell the public IP prefix and internal users will need it before you decommission the vending machines.

The PANW definitely can provide a solution via NAT, but adding complexity to the design comes with its own problems.

Thanks,

Tom