NAT on the Cisco 3750 / 3560 L3 switches

Posted on 2006-04-14
Last Modified: 2013-11-16
Could you kindly help me with the following questions:

1) Is there any flavour of the Cisco IOS on the 3750 or 3560 L3 switches that can do NAT ?

2) We are planning to replace an existing Linux machine running a huge number of iptables NAT rules and static routes with a suitable Cisco device (preferably a Layer3 switch).Is this a good idea ? Is this even feasible ? If not, what are the other options    
available ?

Please advise.

Question by:jaisimha_4474
    LVL 57

    Accepted Solution

    I would call Cicso or a trusted reseller in your area.  I don't beleive that either of these support NAT.  In fact I don't think that Cicso has NAT in any of their layer 3 switches.  The "exception" is the Cat 6500, with a firewall module in it, it (really the firewall module) can do NAT.

    Now, I would assume that you are really using the Linux machine as a router/firewall and not a "layer 3 switch.  Yes a layer 3 switch is like a router, but it is not.  I would also assume that you don't 24 or 48 Ethernet NIC is it.

    So, I would look at how many ports you really need and then look at some Cicso routers that do support NAT.
    LVL 79

    Expert Comment

    I have not yet seen any Cisco Layer 3 switches that will perform NAT.
    Your best bet would be a ASA5000 firewall. How many routed interfaces do you need?

    Author Comment

    Thanks to both giltjr and lrmoore for the comments and advise.

    I am now looking at a suitable version of the 6500 and also the Cisco 3845 ISR security router.

    Looks like both of them can do NAT and PAT to large extent and also have enough interfaces for our rquirements.

    But the main question I have is - can they do NAT /PAT like iptables ? How will the performance be for something like 150 to 200 NAT static NAT rules ?

    For example - can the cisco IOS do NAT like this - as in Linux IPtables:

    1) DNAT with port translation (including a non- standard port)

    iptables -t nat -A PREROUTING -d -p tcp -i eth2 --dport 2506 -j DNAT --to

    2) SNAT (with source and destination specified)

    iptables -t nat -A POSTROUTING -p tcp -o eth2 -s -d -j SNAT --to

    3) Plain SNAT

    iptables -t nat -A POSTROUTING -p tcp -o eth2 -s -j SNAT --to

    Any inputs will be greatly appreciated.

    LVL 79

    Assisted Solution

    The 6500, as big a beast as it is will not do NAT without a firewall blade in it.

    How many separate interfaces do you need? ASA5500 series come with 2x 10/100/1000 and 3x 10/100, and yes, you can do just about anything you need with ip nat commands. ASA/PIX does it very differently than router IOS.
    I would strongly recommend ASA over a 3845 router unless you need the WAN interface capabilities of the router.
    LVL 57

    Expert Comment

    True, the 6500 needs the firewall blade and IIRC the blade lists for $21,000.

    The ASA5000 is a good choice, PIX is next.  Not sure if I would recommend a 3845 for this, unless as lrmoore stated you need WAN interfaces.

    Author Comment

    Thanks for feedback and suggestions.I now some clarity on how to proceed.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Some time ago I was asked to set up a web portal PC to put at our entrance. When customers arrive, they could see a webpage 'promoting' our company. So I tried to set up a windows 7 PC as a kiosk PC.......... I will spare you all the annoyances I…
    Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now