topic Hi, I believe there shouldn't in Network Security

WARNING: real-address conflict with existing static

jmattbullen — Tue, 12 Mar 2019 04:41:24 GMT

hello all. In my DMZ environment I usually use 1-1 static nats. I currently have a need to PAT one of my DMZ boxes so that outside users connect into port 443 but translates into 8080. I did the following which in my mind would mean if traffic comes in on 443 it will get translated to 8080 but anything else it just comes on through as it's original dest port as long as there is an ACL for it. However I got the warning message in the title so I wanted to ask the community what possible side-effects there could be.

static (dmz,outside) tcp 4.4.4.4 https 172.18.13.95 8080 netmask 255.255.255.255

static (dmz,outside) 4.4.4.4 172.18.13.95 netmask 255.255.255.255

WARNING: real-address conflict with existing static

mapped-address conflict with existing static

Hi, I believe there shouldn't

nkarthikeyan — Thu, 28 Aug 2014 13:08:05 GMT

Hi,

I believe there shouldn't be any problem. This is just a warning message for a the overlapping NAT rule in place....

Regards

Karthik

Without having seen your full

Marius Gunnerud — Thu, 28 Aug 2014 19:53:14 GMT

Without having seen your full configuration including NAT, I would say that there is another static NAT statement that matches the IPs and ports of the NAT statement you are trying to add.

As for the consiquences of having both, If the other statement maps the translation between different interfaces and it is located higher on the NAT list, ie. it will be matched first, then you could get an incorrect result in your translation.

Please remember to select a correct answer and rate helpful posts