I have the following config (IOS 12.3):
A.B.C.13 stands for the outside, public IP, bound on interface Fa0/1.52
37.247.X.206 is a public client I am using to test
x.x.x.n stands for a random public peer that connects to A.B.C.13
y.y.y.n stands for a random public peer that connects to A.B.C.13
z.z.z.n stands for a random public peer that connects to A.B.C.13
interface FastEthernet0/1.52 description *** OUTSIDE *** encapsulation dot1Q 52 ip address A.B.C.13 255.255.255.192 ip access-group ACL_FW_FROM_OUTSIDE in ip nat outside interface FastEthernet0/1.312 description *** INSIDE *** encapsulation dot1Q 312 ip address 172.19.128.254 255.255.255.0 ip nat inside ip nat inside source list ACL_NAT_FROM_INSIDE interface FastEthernet0/1.52 overload ip nat inside source static tcp 172.23.10.151 25 A.B.C.13 25 extendable
For me this looks like there is one D-NAT configured, translating outside A.B.C.13:25 to 172.23.10.151:25 - this works as expected. However, I have various translations that translate A.B.C.13:443 to the internal host 172.19.128.152:443 as shown in show ip nat translations:
router# show ip nat translations | i 443 tcp A.B.C.13:443 172.19.128.152:443 x.x.x.84:54019 x.x.x.84:54019 tcp A.B.C.13:443 172.19.128.152:443 y.y.y.30:4143 y.y.y.30:4143 tcp A.B.C.13:443 172.19.128.152:443 z.z.z.42:10890 z.z.z.42:10890
Where are these translationes defined?
There is not a single line containing 172.19.128.152 in the running-config.
The only config statement that relates to communication on port 443 is defined in the referenced ACL "ACL_FW_FROM_OUTSIDE":
Extended IP access list ACL_FW_FROM_OUTSIDE 170 permit tcp any host A.B.C.13 eq 443 (149602 matches)
If I delete this line, communication with the service on port 443 (Outlook Web Access) doesn't work anymore (as one would expect). But where is the translation coming from? How does the IOS know to translate A.B.C.13:443 to internal host 172.19.128.152 ?
Thanks in advance for your feedback!
I can just see and experience that my connection from outside (from 37.247.X.206:443) to A.B.C.13:443 is dest-NATed to the internal host 172.19.128.152:443 - not only on the CLI, but because the OutlookWebAccess-Interface gets served and displayed in my browser.
router#show ip nat translations | i 206 tcp A.B.C.13:443 172.19.128.152:443 37.247.X.206:26064 37.247.X.206:26064
If i disconnect the host 172.19.128.152 - than the connection wont work - OutlookWebAccess wont show up.
Also it's clear that this flow is going through this very system, because when I delete the ACE for A.B.C.13:443 it also leads to the service not beeing served.
Session 6443D284 (37.247.X.206:26694)=>(172.19.128.152:443) tcp SIS_OPEN
show ip nat tr | inc ---will usually show all active maps (even if they aren't in the config) A
clear ip nat tr *sometimes clears things up, but a reboot is the only 100% certain way.