Configuring Internal Access to Bypass Public IP NAT Resolution in NSX
search cancel

Configuring Internal Access to Bypass Public IP NAT Resolution in NSX

book

Article ID: 453787

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • A URL is only resolved to a Public IP address NAT'd to a private IP address located on an NSX Segment
  • Access to this device hosting the URL will need to traverse a T1/T0 Service Router (SR)
  • Other devices attached to the same T1 gateway on the same or adjacent segments are only able to reach the URL via the Public/NATed IP.  This would hairpin traffic from the virtual network to the physical network and back to the virtual network 

Environment

VMware NSX

Cause

When a device is attached to the same NSX segment as the IP address a URL resolves to, traffic is routed directly to that resolved IP address. This behavior occurs because NSX processes internal traffic between segments on the same gateway locally to optimize network performance. As a result, this local routing bypasses the centralized NAT service (Services Router) where public-to-local IP rules are defined.

Resolution

To successfully perform this access request to the real IP address of the device hosting the URL and bypass the NAT requirement, implement one of the following methods:

  1. Local Segment Access: Access the URL from a device attached to the exact same NSX Segment as the target webpage's IP address. Ensure no NAT is involved (if a DNS server is used by the device, the resolution of the URL must point directly to the private IP address or subnet of the device hosting the URL).

  2. Split-Brain DNS Configuration: Configure a Split-Brain DNS architecture so that internal users query a DNS server resolving the webpage to an internal IP address, while external DNS servers resolve it to the external IP address.

  3. Host File Modification: Add a manual host entry in the accessing device's local host file to resolve the URL directly to the private IP address assigned to the target device.

  4. Gateway Alignment: Ensure that the target URL/device is attached to the same Tier-1 (T1) gateway as the client device attempting to access it.

Additional Information

Please reference the following KB for NSX routing beahvior:  NSX-T T1 router routing precedence: Directly connected networks always override more specific routes within the same T1

Powered by Wolken Software