0

I have port forwarding configured on a CISCO 887 for client VPN like this: "ip nat inside source static udp 10.65.1.1 500 interface Loopback1 500" It forwards them to a VPN server.

However, now I am trying to set up a site-site VPN, but the tunnel fails to activate because port 500 is being forwarded to the server instead of using the Tunnel. I can't remove it because then users can't log in.

I have read that I should use route-map like this: "ip nat inside source static udp 10.65.1.1 500 interface Loopback1 500 route-map my_route_map" And my_route_map would permit which addresses the forwarding would apply to. However, the router does not seem to recognize this command.

There is this command: "ip nat inside source route-map my_route_map interface Loopback1 overload", but I don't think this controls port forwarding.

I am not very familiar with routing. Is there a way I can achieve port forwarding, but only for specific source addresses? i.e. if it is from a certain IP, don't forward it, otherwise do forward.

2

interface:500 can only be bound once. Either the router's tunnel process has that IP and port, or the NAT engine does. One can limit when NAT applies, but there's no such ability for an application binding a port.

(There are some VRF tricks that can move the tunnel off the outside interface, but this gets very messy.)

1
  • The OP could terminate the tunnel on a loopback interface and forward to that.
    – Zac67
    Jul 30 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.