Cisco 4200 series running IOS XE with a single public IP address and dynamic NAT, which works just fine. I am trying to add Static NAT to access a server (map external port XX to internal port YY. Below, GigabitEthernet0/0/0 is the WAN interface, a.b.c.d is the server I am trying access from the outside world.
ip nat inside source route-map nat-internet interface GigabitEthernet0/0/0 overload
ip nat inside source static tcp a.b.c.d YY interface GigabitEthernet0/0/0 XX
ip access-list extended internet-acl
permit ip a.b.c.0 0.0.0.255 any
route-map nat-internet permit 1
match ip address internet-acl
match interface GigabitEthernet0/0/0
This configuration doesn't work. I can ping the server a.b.c.d and access services at port YY from the router, but a connection from the outside world to the WAN IP at port XX times out. Port scanning shows the port to be closed.
Here is the output of sh ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp <WAN-IP>:XX a.b.c.d:YY --- ---
EDIT: I see the error in that the ACL for dynamic NAT includes the host I'm attempting to Static NAT (now fixed). The complete configuration is:
interface GigabitEthernet0/0/0
ip address dhcp
ip nat outside
negotiation auto
interface GigabitEthernet0/0/1
no ip address
negotiation auto
interface GigabitEthernet0/0/1.2
encapsulation dot1Q 2
ip address 10.60.2.2 255.255.255.0
interface GigabitEthernet0/0/1.4
encapsulation dot1Q 4
ip address 10.60.4.2 255.255.255.0
ip nat inside
interface GigabitEthernet0/0/1.9
encapsulation dot1Q 9
ip address 10.60.9.2 255.255.255.0
ip nat inside
interface GigabitEthernet0/0/1.20
encapsulation dot1Q 20
ip address 10.60.20.2 255.255.255.0
ip nat inside
ip nat inside source static tcp 10.60.9.31 <YY> interface GigabitEthernet0/0/0 <XX>
ip nat inside source route-map NAT-Internet interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip route 10.60.6.0 255.255.255.0 10.60.4.1
ip route 10.60.8.0 255.255.255.0 10.60.4.1
ip route 10.60.10.0 255.255.255.0 10.60.4.1
ip access-list extended Internet-ACL
permit ip 10.60.6.0 0.0.0.255 any
permit ip 10.60.8.0 0.0.0.255 any
permit ip 10.60.10.0 0.0.0.255 any
route-map NAT-Internet permit 10
match ip address Internet-ACL
match interface GigabitEthernet0/0/0
Any ideas what might be wrong here?
match ip addresspart of the route-map. Please provide the complete (sanitized) configuration as there may be other problems.show ip nat translations inside 10.60.9.31. However, the connection times out (I am able to access that machine at port 22 fine from within the router, as mentioned in the post). I'm mapping local portYY=22 (SSH) on 10.60.9.31 to an outside port.