I have the following config (IOS 12.3):

A.B.C.13 stands for the outside, public IP, bound on interface Fa0/1.52

37.247.X.206 is a public client I am using to test

x.x.x.n stands for a random public peer that connects to A.B.C.13

y.y.y.n stands for a random public peer that connects to A.B.C.13

z.z.z.n stands for a random public peer that connects to A.B.C.13

interface FastEthernet0/1.52
 description *** OUTSIDE ***
 encapsulation dot1Q 52
 ip address A.B.C.13
 ip access-group ACL_FW_FROM_OUTSIDE in
 ip nat outside

interface FastEthernet0/1.312
 description *** INSIDE ***
 encapsulation dot1Q 312
 ip address
 ip nat inside

ip nat inside source list ACL_NAT_FROM_INSIDE interface FastEthernet0/1.52 overload
ip nat inside source static tcp 25 A.B.C.13 25 extendable

For me this looks like there is one D-NAT configured, translating outside A.B.C.13:25 to - this works as expected. However, I have various translations that translate A.B.C.13:443 to the internal host as shown in show ip nat translations:

router# show ip nat translations | i 443

tcp A.B.C.13:443 x.x.x.84:54019 x.x.x.84:54019
tcp A.B.C.13:443 y.y.y.30:4143 y.y.y.30:4143
tcp A.B.C.13:443 z.z.z.42:10890 z.z.z.42:10890

Where are these translationes defined?

There is not a single line containing in the running-config.

The only config statement that relates to communication on port 443 is defined in the referenced ACL "ACL_FW_FROM_OUTSIDE":

Extended IP access list ACL_FW_FROM_OUTSIDE
170 permit tcp any host A.B.C.13 eq 443 (149602 matches)

If I delete this line, communication with the service on port 443 (Outlook Web Access) doesn't work anymore (as one would expect). But where is the translation coming from? How does the IOS know to translate A.B.C.13:443 to internal host ?

Thanks in advance for your feedback!


I can just see and experience that my connection from outside (from 37.247.X.206:443) to A.B.C.13:443 is dest-NATed to the internal host - not only on the CLI, but because the OutlookWebAccess-Interface gets served and displayed in my browser.

router#show ip nat translations | i 206
tcp A.B.C.13:443 37.247.X.206:26064 37.247.X.206:26064

If i disconnect the host - than the connection wont work - OutlookWebAccess wont show up.

Also it's clear that this flow is going through this very system, because when I delete the ACE for A.B.C.13:443 it also leads to the service not beeing served.

Session 6443D284 (37.247.X.206:26694)=>( tcp SIS_OPEN
  • 1
    Either it is in your config (running config, vs. startup config), or it's a phantom element due to several bugs in old IOS NAT. (can happen when configs are changed a lot, or when DHCP is involved.) show ip nat tr | inc --- will usually show all active maps (even if they aren't in the config) A clear ip nat tr * sometimes clears things up, but a reboot is the only 100% certain way.
    – Ricky
    Oct 11, 2018 at 6:19
  • It seems like this was a phantom element - no translation after a reboot. Thank you very much!
    – acse
    Oct 12, 2018 at 12:28
  • Please consider accepting your answer so this question will be closed.
    – Teun Vink
    Oct 12, 2018 at 13:40

1 Answer 1


It seems like this was a phantom element - no translation after a reboot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.