Inbound NAT for SIP port ranges

[paulwhitecisco]

Looking for some guidance on the correct configuration for inbound NATs with various ports due to SIP requirements. 

basically i have a free IP address out of my static external range - i don't want to add a dozen ip nat inside source static lines into my config. 

I'm sure i should be able to create a nat line that references an ACL that will allow me to complete the above requirements - i don't know how this should 'look' 

[Philip D'Ath]

What kind of device do you have?

[paulwhitecisco]

1941 router - one interface external, one internal. I'd like to have incoming nats and out going nats on then same, currently spare, ip address from then external range. 

[Philip D'Ath]

If a.b.c.d is the internal server address, and e.f.g.h is the public outside IP address, then just use:

ip nat inside source static a.b.c.d e.f.g.h

[Philip D'Ath]

I would also tend to disable the SIP ALG with the below command.  Your inbound ACL should only reference the public IP address.

no ip nat service sip udp port 5060

[paulwhitecisco]

I think its a little more complicated that that  -

I was thinking a little more like the below - I can have a static external ip address designated for SIP, but from inside I can be very specific about the outbound ports that I nat to the external ip.   

Outside --> Inside:

ip nat pool SIP_OUT x.x.x.x x.x.x.x prefix-length 29

ip nat inside destination list SIP_OUT pool SIP overload

ip access-list extended SIP_OUT

permit ip host y.y.y.y any

Inside --> Outside:

ip nat inside source static y.y.y.y x.x.x.x route-map SIP

ip access-list extended SIP

permit udp host y.y.y.y eq 5060 any

permit udp host  y.y.y.y range 40000 50000 any

permit udp host  y.y.y.y eq 50700 any

permit udp host  y.y.y.y eq 50800 any

permit udp host  y.y.y.y eq 50900 any

route-map SIP permit 10

match ip address SIP

route-map SIP deny 20

[Philip D'Ath]

Why would you want to do that?  The 1:1 NAT is considerably simpler and will work perfectly.