2

I have a Cisco 2851 with NAT configured as so:

ip nat inside source list 111 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.16.16 64.xxx.xxx.233
ip nat inside source static 192.168.16.2 64.xxx.xxx.245
ip nat inside source static 192.168.16.20 64.xxx.xxx.246
ip route 0.0.0.0 0.0.0.0 64.xxx.xxx.1

I need to forward only outside traffic from 64.xxx.xxx.233 to port 81 to the inside host 192.168.16.12, leaving all other ports as above. This command:

ip nat inside source static tcp 192.168.16.12 81 64.xxx.xxx.233 81

results in this error:

similar static entry (192.168.16.16 -> 64.xxx.xxx.233) already exists

Can give me some direction how to get this single port directed to another host given the above?

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7 '17 at 22:08
0

You need to understand the different NAT versions. NAT inside source translates source addresses packets originating on the inside, and it maintains tables for returning traffic.

If you want to translate addresses from outside which are destined to the inside, you need to use inside destination NAT. This version of NAT can also be used to load balance among multiple inside destinations.

Cisco IOS Network Address Translation Overview:

Enabling translation of inside destination addresses

ip nat inside destination { list <acl> pool <name> | static <global-ip> <local-ip> }

This command is similar to the source translation command. For dynamic destination translation to make any sense, the pool should be a rotary-type pool.

Edit:

Since the outside address is already in the NAT tables with a different rule, you will not be able to have a different translation for it since a lookup of the address will only return one of the table entries.

3
  • Still won't work. It's either 1:1 NAT, or PAT -- I've tried this for years. You cannot do both at the same time, with the same address. (using the interface's address is the only exception) (Note: you can get into the running-config, but it'll never be stable)
    – Ricky
    Mar 22 '16 at 21:26
  • I didn't see the same address; I was looking at the inside addresses.
    – Ron Maupin
    Mar 22 '16 at 21:33
  • Thank you kindly for your time to help me. My solution thus far is specifying ports to avoid overlap. ip nat inside source static tcp 192.168.16.12 81 64.xxx.xxx.245 81 extendable ip nat inside source static tcp 192.168.16.2 1723 64.xxx.xxx.245 1723 extendable
    – STWilson
    Mar 23 '16 at 13:09
0

My solution was to specify ports to avoid overlap:

ip nat inside source static tcp 192.168.16.12 81 64.xxx.xxx.245 81 extendable 
ip nat inside source static tcp 192.168.16.2 1723 64.xxx.xxx.245 1723 extendable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.