Cisco 4200 series running IOS XE with a single public IP address and dynamic NAT, which works just fine. I am trying to add Static NAT to access a server (map external port
XX to internal port
GigabitEthernet0/0/0 is the WAN interface,
a.b.c.d is the server I am trying access from the outside world.
ip nat inside source route-map nat-internet interface GigabitEthernet0/0/0 overload ip nat inside source static tcp a.b.c.d YY interface GigabitEthernet0/0/0 XX ip access-list extended internet-acl permit ip a.b.c.0 0.0.0.255 any route-map nat-internet permit 1 match ip address internet-acl match interface GigabitEthernet0/0/0
This configuration doesn't work. I can ping the server
a.b.c.d and access services at port
YY from the router, but a connection from the outside world to the WAN IP at port
XX times out. Port scanning shows the port to be closed.
Here is the output of
sh ip nat translations
Pro Inside global Inside local Outside local Outside global tcp <WAN-IP>:XX a.b.c.d:YY --- ---
EDIT: I see the error in that the ACL for dynamic NAT includes the host I'm attempting to Static NAT (now fixed). The complete configuration is:
interface GigabitEthernet0/0/0 ip address dhcp ip nat outside negotiation auto interface GigabitEthernet0/0/1 no ip address negotiation auto interface GigabitEthernet0/0/1.2 encapsulation dot1Q 2 ip address 10.60.2.2 255.255.255.0 interface GigabitEthernet0/0/1.4 encapsulation dot1Q 4 ip address 10.60.4.2 255.255.255.0 ip nat inside interface GigabitEthernet0/0/1.9 encapsulation dot1Q 9 ip address 10.60.9.2 255.255.255.0 ip nat inside interface GigabitEthernet0/0/1.20 encapsulation dot1Q 20 ip address 10.60.20.2 255.255.255.0 ip nat inside ip nat inside source static tcp 10.60.9.31 <YY> interface GigabitEthernet0/0/0 <XX> ip nat inside source route-map NAT-Internet interface GigabitEthernet0/0/0 overload ip forward-protocol nd ip route 10.60.6.0 255.255.255.0 10.60.4.1 ip route 10.60.8.0 255.255.255.0 10.60.4.1 ip route 10.60.10.0 255.255.255.0 10.60.4.1 ip access-list extended Internet-ACL permit ip 10.60.6.0 0.0.0.255 any permit ip 10.60.8.0 0.0.0.255 any permit ip 10.60.10.0 0.0.0.255 any route-map NAT-Internet permit 10 match ip address Internet-ACL match interface GigabitEthernet0/0/0
Any ideas what might be wrong here?