I have the following config (IOS 12.3):

A.B.C.13 stands for the outside, public IP, bound on interface Fa0/1.52

37.247.X.206 is a public client I am using to test

x.x.x.n stands for a random public peer that connects to A.B.C.13

y.y.y.n stands for a random public peer that connects to A.B.C.13

z.z.z.n stands for a random public peer that connects to A.B.C.13

interface FastEthernet0/1.52
 description *** OUTSIDE ***
 encapsulation dot1Q 52
 ip address A.B.C.13 255.255.255.192
 ip access-group ACL_FW_FROM_OUTSIDE in
 ip nat outside



interface FastEthernet0/1.312
 description *** INSIDE ***
 encapsulation dot1Q 312
 ip address 172.19.128.254 255.255.255.0
 ip nat inside



ip nat inside source list ACL_NAT_FROM_INSIDE interface FastEthernet0/1.52 overload
ip nat inside source static tcp 172.23.10.151 25 A.B.C.13 25 extendable

For me this looks like there is one D-NAT configured, translating outside A.B.C.13:25 to 172.23.10.151:25 - this works as expected. However, I have various translations that translate A.B.C.13:443 to the internal host 172.19.128.152:443 as shown in show ip nat translations:

router# show ip nat translations | i 443

tcp A.B.C.13:443 172.19.128.152:443 x.x.x.84:54019 x.x.x.84:54019
tcp A.B.C.13:443 172.19.128.152:443 y.y.y.30:4143 y.y.y.30:4143
tcp A.B.C.13:443 172.19.128.152:443 z.z.z.42:10890 z.z.z.42:10890

Where are these translationes defined?

There is not a single line containing 172.19.128.152 in the running-config.

The only config statement that relates to communication on port 443 is defined in the referenced ACL "ACL_FW_FROM_OUTSIDE":

Extended IP access list ACL_FW_FROM_OUTSIDE
170 permit tcp any host A.B.C.13 eq 443 (149602 matches)

If I delete this line, communication with the service on port 443 (Outlook Web Access) doesn't work anymore (as one would expect). But where is the translation coming from? How does the IOS know to translate A.B.C.13:443 to internal host 172.19.128.152 ?

Thanks in advance for your feedback!

/edit:

I can just see and experience that my connection from outside (from 37.247.X.206:443) to A.B.C.13:443 is dest-NATed to the internal host 172.19.128.152:443 - not only on the CLI, but because the OutlookWebAccess-Interface gets served and displayed in my browser.

router#show ip nat translations | i 206
tcp A.B.C.13:443 172.19.128.152:443 37.247.X.206:26064 37.247.X.206:26064

If i disconnect the host 172.19.128.152 - than the connection wont work - OutlookWebAccess wont show up.

Also it's clear that this flow is going through this very system, because when I delete the ACE for A.B.C.13:443 it also leads to the service not beeing served.

Session 6443D284 (37.247.X.206:26694)=>(172.19.128.152:443) tcp SIS_OPEN
  • 1
    Either it is in your config (running config, vs. startup config), or it's a phantom element due to several bugs in old IOS NAT. (can happen when configs are changed a lot, or when DHCP is involved.) show ip nat tr | inc --- will usually show all active maps (even if they aren't in the config) A clear ip nat tr * sometimes clears things up, but a reboot is the only 100% certain way. – Ricky Beam Oct 11 at 6:19
  • It seems like this was a phantom element - no translation after a reboot. Thank you very much! – acse Oct 12 at 12:28
  • Please consider accepting your answer so this question will be closed. – Teun Vink Oct 12 at 13:40
up vote 0 down vote accepted

It seems like this was a phantom element - no translation after a reboot.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.