1

Should static NAT using "outside" work the same as "inside"

Topology:

enter image description here

For example, say I use:

ip nat inside static source 192.168.1.1 10.1.1.50 
  1. I try to ping 10.1.1.100 from 192.168.1.1
  2. source address will get NAT'd from 192.168.1.1 to 10.1.1.50
  3. ping goes to 10.1.1.100, which replies 10.1.1.50
  4. ping's destination address gets changed from 10.1.1.50 to 192.168.1.1
  5. ping complete

If I try the opposite

ip nat outside static source 10.1.1.100 192.168.1.50 
  1. I try to ping 192.168.1.1 form 10.1.1.100
  2. source address will get NAT'd from 10.1.1.100 192.168.1.50
  3. ping goes to 192.168.1.1, which replies 192.168.1.50
  4. I anticipate ping's destination address gets changed from 192.168.1.50 to 10.1.1.100 but doesn't
  5. ping dropped at 192.168.1.50 as it is not expecting a ping

Why does an "inside" NAT rule work fine both ways, but an "outside" rule fails on return?

Using packet tracer, so according to the 4321 router, it's IOS15.4

Config (inside NAT)

no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
ip cef
no ipv6 cef
!
!
spanning-tree mode pvst
!
!
interface GigabitEthernet0/0/0
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip nat inside source static 192.168.1.1 10.1.1.50
ip classless
!
ip flow-export version 9
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Config (outside NAT)

no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
ip cef
no ipv6 cef
!
!
spanning-tree mode pvst
!
!
interface GigabitEthernet0/0/0
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip nat outside source static 10.1.1.100 192.168.1.50
ip classless
!
ip flow-export version 9
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end```

5
  • Can we see more of your configuration? Particularly the rest of the nat config, the interfaces, and any related access lists? – Darrell Root Aug 1 '19 at 5:15
  • only other piece of info is 192.1.1.2 is set as "inside" and 10.1.1.1 is set as "outside"... no ACL's etc... this is all nice and simple... hence why I'm wondering why it won't work.... diagram added – user10021657 Aug 2 '19 at 13:46
  • Please edit the question to include the full router configuration. – Ron Maupin Aug 2 '19 at 13:49
  • "ip nat inside static" and "ip nat outside static" work in different way. Two weeks ago there is the almost same question, you can take a look networkengineering.stackexchange.com/questions/60521/… – Konstantin Goncharenko Aug 2 '19 at 13:55
  • Configs added.... Konstantin, could you expand on how "ip nat inside static" and "ip nat outside static" work in different way? As this is what I am looking into, the question in the link doesn't exactly explain it. To me, I had the understanding that when using the outside rule, it would be similar to the inside rule (and function) where a ping from 10.1.1.100 to 192.168.1.2 would hit the router, source address be translated to 192.168.1.30, ping the .2 PC. Which in turn replies with a ping to 192.168.1.30, where I thought NAT would translate back to 10.1.1.100 and not get dropped at .30. – user10021657 Aug 3 '19 at 19:06
2

I believe you need to add the "add-route" suffice to the command.

ip nat outside static source 10.1.1.100 192.168.1.50 add-route

Per this explanation:

When you configure the ip nat outside source static command to add static routes for outside local addresses, there is a delay in the translation of packets and packets are dropped. Packets are dropped because a shortcut is not created for the initial synchronization (SYN) packet when NAT is configured for static translation. To avoid dropped packets, configure either the ip nat outside source static add-route command or the ip route command.

1
  • This worked exactly how I wanted it to, thanks very much for the help and explanation! – user10021657 Aug 5 '19 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.