Cisco IOS 12.3 - Mysterious NAT - Where is it defined?

Question

I have the following config (IOS 12.3):

A.B.C.13 stands for the outside, public IP, bound on interface Fa0/1.52

37.247.X.206 is a public client I am using to test

x.x.x.n stands for a random public peer that connects to A.B.C.13

y.y.y.n stands for a random public peer that connects to A.B.C.13

z.z.z.n stands for a random public peer that connects to A.B.C.13

interface FastEthernet0/1.52
 description *** OUTSIDE ***
 encapsulation dot1Q 52
 ip address A.B.C.13 255.255.255.192
 ip access-group ACL_FW_FROM_OUTSIDE in
 ip nat outside



interface FastEthernet0/1.312
 description *** INSIDE ***
 encapsulation dot1Q 312
 ip address 172.19.128.254 255.255.255.0
 ip nat inside



ip nat inside source list ACL_NAT_FROM_INSIDE interface FastEthernet0/1.52 overload
ip nat inside source static tcp 172.23.10.151 25 A.B.C.13 25 extendable

For me this looks like there is one D-NAT configured, translating outside A.B.C.13:25 to 172.23.10.151:25 - this works as expected. However, I have various translations that translate A.B.C.13:443 to the internal host 172.19.128.152:443 as shown in show ip nat translations:

router# show ip nat translations | i 443

tcp A.B.C.13:443 172.19.128.152:443 x.x.x.84:54019 x.x.x.84:54019
tcp A.B.C.13:443 172.19.128.152:443 y.y.y.30:4143 y.y.y.30:4143
tcp A.B.C.13:443 172.19.128.152:443 z.z.z.42:10890 z.z.z.42:10890

Where are these translationes defined?

There is not a single line containing 172.19.128.152 in the running-config.

The only config statement that relates to communication on port 443 is defined in the referenced ACL "ACL_FW_FROM_OUTSIDE":

Extended IP access list ACL_FW_FROM_OUTSIDE
170 permit tcp any host A.B.C.13 eq 443 (149602 matches)

If I delete this line, communication with the service on port 443 (Outlook Web Access) doesn't work anymore (as one would expect). But where is the translation coming from? How does the IOS know to translate A.B.C.13:443 to internal host 172.19.128.152 ?

Thanks in advance for your feedback!

/edit:

I can just see and experience that my connection from outside (from 37.247.X.206:443) to A.B.C.13:443 is dest-NATed to the internal host 172.19.128.152:443 - not only on the CLI, but because the OutlookWebAccess-Interface gets served and displayed in my browser.

router#show ip nat translations | i 206
tcp A.B.C.13:443 172.19.128.152:443 37.247.X.206:26064 37.247.X.206:26064

If i disconnect the host 172.19.128.152 - than the connection wont work - OutlookWebAccess wont show up.

Also it's clear that this flow is going through this very system, because when I delete the ACE for A.B.C.13:443 it also leads to the service not beeing served.

Session 6443D284 (37.247.X.206:26694)=>(172.19.128.152:443) tcp SIS_OPEN

Answer 1

It seems like this was a phantom element - no translation after a reboot.