Configuring static NAT on Cisco Router

Question

I am trying to configure port forwarding on a Cisco 891F router given by an ISP and directly connected to servers in the 192.168.170.0/24 network. The ISP recommended using the ip nat inside source static tcp 192.168.170.108 8080 1.2.3.4 8080 extendable but this along with other rules to the other servers are not functioning.
Internet has been configured using a standard access-list and changing the config may log everyone connected remotely out.
What ip nat commands can I use to achieve Port Forwarding to the servers via the public IP?
Part of the Router Config

ip nat inside source list 1 interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.170.108 8080 1.2.3.4 8080 extendable
ip nat inside source static tcp 192.168.170.100 9000 1.2.3.4 9000 extendable
ip route 0.0.0.0 0.0.0.0 1.2.3.1
!
!
access-list 1 permit 192.168.170.0 0.0.0.255
`

Answer 1

If Gig8 gets it's IP address dynamically (DHCP, PPPoE), you'll have to do this (in short: replace 1.2.3.4 with the interface name).

ip nat inside source static tcp 192.168.170.108 8080 gigabitEthernet8 8080 
ip nat inside source static tcp 192.168.170.100 9000 gigabitEthernet8 9000 

Having 1.2.3.4 at this place in the NAT statement would only work if ...

• either gig8 has this address configured (static adressing)
• or if the next-hop upstream router has a route for 1.2.3.4 that points to the actual address of Gig8.

If your are running CBAC (context based access control with ip inspect...) or ZBFW (zone based firewall), or if you have an inbound ACL on the outer interface for some other reason, there will be an access-list to/for the external Interface that will have to include something like this:

 ...
 permit tcp any host 192.168.170.108 eq 8080
 permit tcp any host 192.168.170.100 eq 9000
 ...

In the case of CBAC or the general purpose access list, these lines need to be part of the inbound access-list that sits on the external interface.

In the case of ZBFW, the ACL should be used by a class-map type inspect match-any <classmapname> which is used in turn by a policy-map type inspect <policymapname> which is in turn used as service-policy type inspect of the given zone-pair security ...

Answer 2

Static NAT is used to translate a single private IP address with a single public IP address. When application is hosted in the internal network wants to access application from internet static NATting is used. It's one to one NATting ...

Configuration part as below

Firstly servers should assigned static ip and make sure servers are reachable from router where this static natting is done

Server1 = 192.168.170.108 Server2=192.168.170.109 Server3=192.168.170.110

Configuration as below for example

Router#(config)# int f0/1 #ip nat inside #no shutdown

Fo/1 = interface is connected to inside network

Router#(config)#int f0/0 #ip nat outside #no shutdown

F0/0= interfàce connected to outside interface for example ISP

Request ISP for 3 static public ips to take forward this requirement

For example ISP has allocated 3 public ip as

1) 210.67.89.10

2)210.67.89.12

3)210.67.89.13

Static nat configuration

Router(config)# ip nat inside source static 192.168.170.108 210.67.89.10

Router(config)#ip nat inside source static 192.168.170.109 210.67.89 12

Router(config)#ip nat inside source static 192.168.170.110 210.67.89.13