We have an mail server and its private address is translated to public on a Cisco router. We've mapped it one-to-one using this command:

ip nat inside source static route-map Deny_on_VPN

Deny_on_VPN route-map has no set clauses, but only blocks traffic from being NAT'ted when being sent to remote locations on VPN, nothing fancy there. Also on outside interface ACL we have permitted incoming traffic to ports needed for mail to function (IMAP,POP3,SMTP,Web Client).

The kind of odd thing is happening during translation. I had a look at show ip nat translations | include The incoming traffic ports translate just fine, like to But the outgoing traffic with a random source port is being translated something like this: to, and always the 80th port. It does the same thing with TCP and UDP packets.

I can't understand why would such thing happen. Maybe any of you network guys can help me out. Please tell me if you need any additional info.


Port address translation config (for users):

ip nat pool ovrld prefix-length 27
ip nat inside source list 107 pool ovrld overload

PAT source list ACL (Mail Server is blocked on the first line from being PAT'ted):

router#show access-lists 107
Extended IP access list 107
    10 deny ip host any (2922102 matches)
    --- Omitted as it is irrelevant ---
    9999 permit ip any any

Relevant lines from inbound ACL on outside interface:

router#show access-lists FILTER_IN
Extended IP access list FILTER_IN
    110 permit tcp any host eq pop3 (3197667 matches)
    120 permit tcp any host eq smtp (4812814 matches)
    130 permit tcp any host eq 143 (299804 matches)
    140 permit tcp any eq domain host (9 matches)
    150 permit udp any eq domain host (120634 matches)
    160 permit tcp any eq www host (271241 matches)
    170 permit tcp any eq smtp host (1033371 matches)
    180 permit icmp any host (18075 matches)
    190 permit tcp any host eq www
    200 deny ip any host (17811 matches)
    210 permit ip any any (4259977862 matches)

VPN_Deny route-map blocks traffic from internal network to branch office subnets from being NAT'ted. No set-clauses.

Note: Translation of mail server address on an overloaded pool is denied in an ACL.

Note: is from TEST-NET-2 range.

  • Can you include the relevant parts of your configuration? Also, what version IOS?
    – Ron Trunk
    Commented Feb 28, 2014 at 7:19
  • I'm sorry if I made it confusing, I just did not include any other lines. I wanted to show, that mailserver is not NAT'ted to overload pool. It sure has permit any any
    – Alex
    Commented Feb 28, 2014 at 7:41
  • Are you saying that the outbound traffic from the server is not going to port 80? Otherwise this is expected behavior.
    – Ron Trunk
    Commented Feb 28, 2014 at 7:44
  • In any case it sends it using source port 80. For example it sends SMTP on TCP/25 to external server. The server uses random source port number, but it is being converted to TCP/80 source port on the router. Same with DNS requests for example. It still is being translated to source port UDP/80. I expected it to translate ports one-to-one, isn't that right?
    – Alex
    Commented Feb 28, 2014 at 7:48

1 Answer 1


This doesn't really answer my question why did NAT always use the 80th port as source port for outgoing traffic, but at least I figured out how to fix the problem.

I created an access list to match traffic from the mail server and also created a pool of one public address for it.

ip access-list extended 109
 !!! Restrict NAT for branch office destinations
 deny ip host
 permit ip host any
ip nat pool MAIL prefix-length 27
ip nat inside source list 109 pool MAIL

And...Voilà! It now preserves the source port number as it sends traffic. And our mail is no longer blocked by some external MTA mail servers.


So now I tried reverting back to:

ip nat source static route-map Deny_On_VPN

And it actually started to translate addresses and ports as expected - one to one. I don't really understand what the deal was with it, maybe a bug? Hopefully it will keep running like this from now on. I guess, I'll have a look at IOS release notes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.