C1111-4P NAT

[vjlopes]

Hello everyone,

I'm having trouble configuring some Cisco C1111-4P (1RU) and need some help.

Cisco IOS XE Software, Version 17.02.02
Cisco IOS Software [Amsterdam], ISR Software (ARMV8EL_LINUX_IOSD-UNIVERSALK9-M), Version 17.2.2, RELEASE SOFTWARE (fc4)

The main objetive is to have a firewall on the LAN, NAT almost every port to it, but maintain remote access to my router via ssh or telnet.

On other Cisco routers i've been able to do it this way:

interface GigabitEthernet0/0/0
description WAN
ip address dhcp
ip nat outside
negotiation auto

interface Loopback0
description Loopback
ip address 1.1.1.1 255.255.255.255
ip nat inside
ip virtual-reassembly in

ip nat inside source static tcp 1.1.1.1 22 interface GigabitEthernet0/0/0 22
ip nat inside source static 192.168.1.100 interface GigabitEthernet0/0/0

Unfortunatly it doesnt work on C1111 as i loose remote access as soon as i apply the last NAT command.

Sorry for any erros. English is not my main language.

Cheers.

[paul driver]

Hello

---

@vjlopes wrote:

have a firewall on the LAN, NAT almost every port to it, but maintain remote access to my router via ssh or telnet.

---

can you elaborate on the topology , provide a diagram also post running config or the rtr?

sh run
sh ip route
sh arp
sh ip int brief

[MHM Cisco World]

how you NAT 1:1 and then use static PAT ??
this not work I think. 
NAT 1:1 meaning that this global IP always nat to local IP. 

[EdgarMurray8920]

I think if you want PAT you need to use the overload

The configuration below is where it seems to me where the error is.

---

ip nat inside source static tcp 1.1.1.1 22 interface GigabitEthernet0/0/0 22

[Georg Pauwen]

Hello,

odd. I just recreated this in a lab, and your config works perfectly. Can you turn on debugging:

debug ip nat

debug ip ssh

and post the output ?

[MHM Cisco World]

Using route maps for conditional NAT – CiscoZine

as I mention before the return back traffic can not work with two static PAT and NAT 1:1 (not work optimal)
try use route-map make your static NAT conditional. 
thnaks