0

I have port forwarding configured on a CISCO 887 for client VPN like this: "ip nat inside source static udp 10.65.1.1 500 interface Loopback1 500" It forwards them to a VPN server.

However, now I am trying to set up a site-site VPN, but the tunnel fails to activate because port 500 is being forwarded to the server instead of using the Tunnel. I can't remove it because then users can't log in.

I have read that I should use route-map like this: "ip nat inside source static udp 10.65.1.1 500 interface Loopback1 500 route-map my_route_map" And my_route_map would permit which addresses the forwarding would apply to. However, the router does not seem to recognize this command.

There is this command: "ip nat inside source route-map my_route_map interface Loopback1 overload", but I don't think this controls port forwarding.

I am not very familiar with routing. Is there a way I can achieve port forwarding, but only for specific source addresses? i.e. if it is from a certain IP, don't forward it, otherwise do forward.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 23, 2021 at 21:02

1 Answer 1

Reset to default
2

interface:500 can only be bound once. Either the router's tunnel process has that IP and port, or the NAT engine does. One can limit when NAT applies, but there's no such ability for an application binding a port.

(There are some VRF tricks that can move the tunnel off the outside interface, but this gets very messy.)

Improve this answer
1
  • The OP could terminate the tunnel on a loopback interface and forward to that.
    – Zac67 ♦
    Commented Jul 30, 2021 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.