We have an mail server and its private address is translated to public on a Cisco router. We've mapped it one-to-one using this command:
ip nat inside source static 192.168.7.7 198.51.100.7 route-map Deny_on_VPN
Deny_on_VPN route-map has no set clauses, but only blocks traffic from being NAT'ted when being sent to remote locations on VPN, nothing fancy there. Also on outside interface ACL we have permitted incoming traffic to ports needed for mail to function (IMAP,POP3,SMTP,Web Client).
The kind of odd thing is happening during translation. I had a look at show ip nat translations | include 192.168.7.7
. The incoming traffic ports translate just fine, like 198.51.100.7:25 to 192.168.7.7:25
. But the outgoing traffic with a random source port is being translated something like this: 192.168.7.7:58634 to 198.51.100.7:80
, and always the 80th port. It does the same thing with TCP and UDP packets.
I can't understand why would such thing happen. Maybe any of you network guys can help me out. Please tell me if you need any additional info.
Update:
Port address translation config (for users):
ip nat pool ovrld 198.51.100.30 198.51.100.31 prefix-length 27
ip nat inside source list 107 pool ovrld overload
PAT source list ACL (Mail Server is blocked on the first line from being PAT'ted):
router#show access-lists 107
Extended IP access list 107
10 deny ip host 192.168.7.7 any (2922102 matches)
--- Omitted as it is irrelevant ---
9999 permit ip any any
Relevant lines from inbound ACL on outside interface:
router#show access-lists FILTER_IN
Extended IP access list FILTER_IN
110 permit tcp any host 198.51.100.7 eq pop3 (3197667 matches)
120 permit tcp any host 198.51.100.7 eq smtp (4812814 matches)
130 permit tcp any host 198.51.100.7 eq 143 (299804 matches)
140 permit tcp any eq domain host 198.51.100.7 (9 matches)
150 permit udp any eq domain host 198.51.100.7 (120634 matches)
160 permit tcp any eq www host 198.51.100.7 (271241 matches)
170 permit tcp any eq smtp host 198.51.100.7 (1033371 matches)
180 permit icmp any host 198.51.100.7 (18075 matches)
190 permit tcp any host 198.51.100.7 eq www
200 deny ip any host 198.51.100.7 (17811 matches)
210 permit ip any any (4259977862 matches)
VPN_Deny
route-map blocks traffic from internal network to branch office subnets from being NAT'ted. No set-clauses.
Note: Translation of mail server address on an overloaded pool is denied in an ACL.
Note: 198.51.100.0/24
is from TEST-NET-2
range.
permit any any
– Alex Feb 28 '14 at 7:41