0

Cisco 4200 series running IOS XE with a single public IP address and dynamic NAT, which works just fine. I am trying to add Static NAT to access a server (map external port XX to internal port YY. Below, GigabitEthernet0/0/0 is the WAN interface, a.b.c.d is the server I am trying access from the outside world.

ip nat inside source route-map nat-internet interface GigabitEthernet0/0/0 overload

ip nat inside source static tcp a.b.c.d YY interface GigabitEthernet0/0/0 XX

ip access-list extended internet-acl
 permit ip a.b.c.0 0.0.0.255 any

route-map nat-internet permit 1
 match ip address internet-acl
 match interface GigabitEthernet0/0/0

This configuration doesn't work. I can ping the server a.b.c.d and access services at port YY from the router, but a connection from the outside world to the WAN IP at port XX times out. Port scanning shows the port to be closed.

Here is the output of sh ip nat translations

Pro  Inside global         Inside local          Outside local         Outside global
tcp  <WAN-IP>:XX           a.b.c.d:YY            ---                   ---

EDIT: I see the error in that the ACL for dynamic NAT includes the host I'm attempting to Static NAT (now fixed). The complete configuration is:

interface GigabitEthernet0/0/0
 ip address dhcp
 ip nat outside
 negotiation auto

interface GigabitEthernet0/0/1
 no ip address
 negotiation auto

interface GigabitEthernet0/0/1.2
 encapsulation dot1Q 2
 ip address 10.60.2.2 255.255.255.0

interface GigabitEthernet0/0/1.4
 encapsulation dot1Q 4
 ip address 10.60.4.2 255.255.255.0
 ip nat inside

interface GigabitEthernet0/0/1.9
 encapsulation dot1Q 9
 ip address 10.60.9.2 255.255.255.0
 ip nat inside

interface GigabitEthernet0/0/1.20
 encapsulation dot1Q 20
 ip address 10.60.20.2 255.255.255.0
 ip nat inside

ip nat inside source static tcp 10.60.9.31 <YY> interface GigabitEthernet0/0/0 <XX>
ip nat inside source route-map NAT-Internet interface GigabitEthernet0/0/0         overload
ip forward-protocol nd
ip route 10.60.6.0 255.255.255.0 10.60.4.1
ip route 10.60.8.0 255.255.255.0 10.60.4.1
ip route 10.60.10.0 255.255.255.0 10.60.4.1

ip access-list extended Internet-ACL
 permit ip 10.60.6.0 0.0.0.255 any
 permit ip 10.60.8.0 0.0.0.255 any
 permit ip 10.60.10.0 0.0.0.255 any


route-map NAT-Internet permit 10 
match ip address Internet-ACL
match interface GigabitEthernet0/0/0

Any ideas what might be wrong here?

  • remove the match ip address part of the route-map. Please provide the complete (sanitized) configuration as there may be other problems. – Ricky Beam Mar 25 '19 at 18:42
  • @RickyBeam posted. I see the issue, which I've fixed. Upon connection, I see a translation show up in show ip nat translations inside 10.60.9.31. However, the connection times out (I am able to access that machine at port 22 fine from within the router, as mentioned in the post). I'm mapping local port YY=22 (SSH) on 10.60.9.31 to an outside port. – user3814483 Mar 28 '19 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.