IP NAT inside source vs IP NAT outside source

Hello Helen

Short answer is “yes”. When you ping VPC10, you will find that the ping reaches the destination, but on the way back, it uses a destination IP address of 10.1.15.100. Based on the configured routing, this would be routed to R9’s 10.1.15.0/24 directly connected subnet, which will then simply be dropped, since no host on that subnet would respond to that destination IP. E0/2 is the outside NAT interface of R2, but because its subnet is different than that of the translated NAT address, the return packet will never come back in on the required outside interface, because it would be routed elsewhere, thus the return translation would not occur. For this reason, the outside local address should be on the same subnet as the IP address of the outside interface.

Remember that routing depends solely based on the destination IP address. In a typical NAT scenario, when an internal device communicates with a device on the outside, the destination address does not get translated, so the order of operations doesn’t affect routing.

For return traffic, from outside to in, it makes sense to have routing take place after the NAT translation. This is because the destination address of the packet before translation, is the outside local address, which actually resides on the outside interface itself. If routing were to take place first, it would have nowhere to send the packet, since the destination address is in essence, on the outside interface. So translation must take place before the packet can be routed to get to its eventual inside destination.

I hope this has been helpful!

Laz