0

Thank you in advance.

I have a few 2851 Cisco ISR. This is my NAT Pool config;

ip nat pool NAT-Pool 38.xxx.xxx.193 38.xxx.xxx.206 prefix-length 28
ip nat inside source list 1 pool NAT-Pool overload
ip nat inside source list 100 pool NAT-Pool overload
ip nat inside source static tcp 172.20.9.3 80 38.xxx.xxx.199 80 extendable
ip nat inside source static tcp 172.20.9.3 443 38.xxx.xxx.199 443 extendable
ip nat inside source static tcp 172.20.9.3 3478 38.xxx.xxx.199 3478 extendable
ip nat inside source static tcp 172.20.9.3 5222 38.xxx.xxx.199 5222 extendable
ip nat inside source static tcp 172.20.9.3 5349 38.xxx.xxx.199 5349 extendable
ip nat inside source static udp 172.20.9.3 10000 38.xxx.xxx.199 10000 extendable

Say I want to add another udp port 10001 to the same IP addresses, I get

similar static entry (38.xxx.xxx.207 -> 38.xxx.xxx.199) already exists

This is what my interface looks like:

interface GigabitEthernet0/0
 ip address 172.20.8.1 255.255.252.0
 ip nat inside
 ip virtual-reassembly
 duplex full
 speed 1000
!
interface GigabitEthernet0/1
 ip address 38.yyy.zzz.178 255.255.255.248
 ip nat outside
 ip virtual-reassembly
 duplex full
 speed 1000

I am running Layer 3 setup.

Now I can add the new NAT entry if the router is rebooted and I immediately add it once it is up. I originally thought that this was the hardware, however I have all 3 routers with identical configurations doing the same thing. Note IP assignment are different on each router.

Thoughts?

Improve this question
2
  • 2
    What command are you using?
    – Ron Maupin ♦
    Commented Sep 6, 2021 at 17:44
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 23, 2021 at 21:47

1 Answer 1

Reset to default
1

This is because "199" is within the NAT pool. As such it's available for PAT. Once it's been used as part of the pool, you will have to clear translations to add a new static -- which is what's happening with a reload.

You could use 1:1 NAT (9.3 == x.199) and have an ACL limit what ports are allowed. The ACL can be modified without issue. And the pool will never use that address.

Improve this answer
1
  • Ok so I thought that I was already doing a 1:1 with the ports. Does this mean that I remove the "ip nat pool NAT-Pool 38.xxx.xxx.193 38.xxx.xxx.206 prefix-length 28" from the config ? Also on the Layer 3 from my ISP, we have class /29 for the WAN and that is a different IP schema entirely from the NAT Pool Example: WAN = 38.77.123.178 255.255.255.248 with gateway of 38.77.123.175 , then we are assigned a class 28 for the POOL of public IPs, Starting 38.xxx.xxx.192 ending 38.xxx.xxx.207 /28
    – Somedude007
    Commented Sep 6, 2021 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.