NATのmatch-in-vrf機能紹介

1.insideインタフェースはVRF green 1、outsideインタフェースはVRF green 1で、テストは以下の通りです.
match-in-vrfがなければ、ip aliasにはglobaアドレスのentryがなく、arpに応答できないのは当然です.

ASR1013-2#sh run vrf green1
Building configuration...

Current configuration : 515 bytes
vrf definition green1
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
!
interface GigabitEthernet0/0/0
 vrf forwarding green1
 ip address 90.1.0.1 255.255.255.0
 ip nat outside
 load-interval 30
 negotiation auto
 cdp enable
!
interface GigabitEthernet0/0/1
 vrf forwarding green1
 ip address 100.100.100.1 255.255.255.0
 ip nat inside
 load-interval 30
 negotiation auto
 cdp enable
ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1 match-in-vrf
!
!
end

ASR1013-2#show ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ASR1013-2(config)#no ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1 match-in-vrf
ASR1013-2(config)#ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1             
ASR1013-2(config)#end
ASR1013-2#show ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2#show ip alias vrf green1
Address Type             IP Address      Port
Interface                90.1.0.1 
Interface                100.100.100.1 
ASR1013-2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ASR1013-2(config)#no ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1             
ASR1013-2(config)# ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1 match-in-vrf  
ASR1013-2(config)#do show ip alias vrf green1
Address Type             IP Address      Port
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
ASR1013-2(config)#end
ASR1013-2#

2.insideインタフェースもoutsideインタフェースもVRF内にない
NAT ruleを指定する場合、vrf情報は不要です.

ASR1013-2#sh run inter gi 0/0/0
Building configuration...

Current configuration : 137 bytes
!
interface GigabitEthernet0/0/0
 ip address 90.1.0.1 255.255.255.0
 ip nat outside
 load-interval 30
 negotiation auto
 cdp enable
end

ASR1013-2#sh run inter gi 0/0/1
Building configuration...

Current configuration : 141 bytes
!
interface GigabitEthernet0/0/1
 ip address 100.100.100.1 255.255.255.0
 ip nat inside
 load-interval 30
 negotiation auto
 cdp enable
end

ASR1013-2#sh run | in ip nat
 ip nat outside
 ip nat inside
ip nat inside source static 100.100.100.142 90.1.0.14
alias exec trans sh ip nat translations total
alias exec natfull sh ip nat translations filter entry-type full total
alias exec nathalf sh ip nat translations filter entry-type half all total
ASR1013-2#show ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2#

3.insideインタフェースはvrf内にあり、outsideインタフェースはglobal内にある.
この場合、異なるvrfからのトラフィックが入る複数のアクセス方法を受信するのが最も一般的であるが、同じglobalアドレスを共有する.
この場合nat ruleはvrfを用いなくてもvrfを用いてもよいし、vrf+match-in-vrfを用いてもよい

ASR1013-2#sh run inter gi 0/0/0
Building configuration...

Current configuration : 137 bytes
!
interface GigabitEthernet0/0/0
 ip address 90.1.0.1 255.255.255.0
 ip nat outside
 load-interval 30
 negotiation auto
 cdp enable
end

ASR1013-2#sh run inter gi 0/0/1
Building configuration...

Current configuration : 164 bytes
!
interface GigabitEthernet0/0/1
 vrf forwarding green1
 ip address 100.100.100.1 255.255.255.0
 ip nat inside
 load-interval 30
 negotiation auto
 cdp enable
end

ASR1013-2#sh run | in ip nat inside
 ip nat inside
ip nat inside source static 100.100.100.142 90.1.0.14
ASR1013-2#show ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ASR1013-2(config)#no ip nat inside source static 100.100.100.142 90.1.0.14
ASR1013-2(config)#ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1
ASR1013-2(config)#do sh ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2(config)#no ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1
ASR1013-2(config)#ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1 match
ASR1013-2(config)#ip nat inside source static 100.100.100.142 90.1.0.14 vrf green1 match-in-vrf 
ASR1013-2(config)#do sh ip alias
Address Type             IP Address      Port
Interface                10.74.9.121 
Interface                90.1.0.1 
Dynamic                  90.1.0.14 
Interface                100.100.100.1 
Interface                192.168.1.2 
ASR1013-2(config)#end
ASR1013-2#

4.insideインタフェースはglobaにあり、outsideインタフェースはvrf内にある.この状況は比較的特殊で、一般的にはない.
5.insideインタフェースはvrfAにあり、outsideインタフェースはvrf Bにあるが、これがVASIの実現である.
一言で言えば,NATは通常のルーティングとは若干異なり,insideとoutsideはglobaとvrf内で4つの組合せがある.一方,match−in−vrf機能は主にinsideとoutsideの両方がvrf内にある用途に用いられる.
Reference:
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/asr1000/nat-xe-3s-asr1k-book/iadnat-match-vrf.html