Should static NAT using "outside" work the same as "inside"
Topology:
For example, say I use:
ip nat inside static source 192.168.1.1 10.1.1.50
- I try to ping 10.1.1.100 from 192.168.1.1
- source address will get NAT'd from 192.168.1.1 to 10.1.1.50
- ping goes to 10.1.1.100, which replies 10.1.1.50
- ping's destination address gets changed from 10.1.1.50 to 192.168.1.1
- ping complete
If I try the opposite
ip nat outside static source 10.1.1.100 192.168.1.50
- I try to ping 192.168.1.1 form 10.1.1.100
- source address will get NAT'd from 10.1.1.100 192.168.1.50
- ping goes to 192.168.1.1, which replies 192.168.1.50
- I anticipate ping's destination address gets changed from 192.168.1.50 to 10.1.1.100 but doesn't
- ping dropped at 192.168.1.50 as it is not expecting a ping
Why does an "inside" NAT rule work fine both ways, but an "outside" rule fails on return?
Using packet tracer, so according to the 4321 router, it's IOS15.4
Config (inside NAT)
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
ip cef
no ipv6 cef
!
!
spanning-tree mode pvst
!
!
interface GigabitEthernet0/0/0
ip address 192.168.1.2 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface GigabitEthernet0/0/1
ip address 10.1.1.1 255.255.255.0
ip nat outside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
ip nat inside source static 192.168.1.1 10.1.1.50
ip classless
!
ip flow-export version 9
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
Config (outside NAT)
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
ip cef
no ipv6 cef
!
!
spanning-tree mode pvst
!
!
interface GigabitEthernet0/0/0
ip address 192.168.1.2 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface GigabitEthernet0/0/1
ip address 10.1.1.1 255.255.255.0
ip nat outside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
ip nat outside source static 10.1.1.100 192.168.1.50
ip classless
!
ip flow-export version 9
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end```