twice NAT at cisco router

[Andriy Sidko]

Hi guys.

I need to implement following scenario:

When inside computer 192.168.172.20/28 opens connection to 192.168.172.1/28 port 777/tcp (192.168.172.1 - is cisco router) connection will rewrite source  to 192.168.172.1/28:1025-65535/tcp and destination to 10.5.8.7:3389/tcp

returning packets from 10.5.8.7:3389/tcp needs to rewrite source 192.168.172.1:777/tcp and destination 192.168.172.20/28

Another words for security requirements RDP to 10.5.8.7:3389/tcp can be accessible from 192.168.172.1/28 only.

Subnet 192.168.172.16/28 isn't advertised and locked (some kind of DMZ :) to 10.5.8.0/24

Could somebody suggest?

Thank you.

[balaji.bandi]

If i were you, i try to avoid double nat, until there is no option in the network to deploy.

if possible make different segment of network for incoming RDP connections.

To give best advice from community post your network topo, and devices involved, which shows the flow, how the incoming connections coming in.