NAT not working

[Alain Nohra]

i have the following nat configured it was working very well, suddenly it's not working anymore.

ip nat inside source static tcp 192.168.4.117 7000 195.112.197.10 7000 extendable

i can telnet on the internal IP 192.168.4.117 on 7000 but cannot telnet on the public IP from external.

the following is the access list also configured:

ip access-list extended NAT-Inside-Outside
deny ip 192.168.4.0 0.0.0.255 172.16.4.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.0.0 0.0.255.255
deny ip 192.168.4.0 0.0.0.255 192.168.3.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.6.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.4.0 0.0.0.255
deny ip 192.168.4.0 0.0.0.255 192.168.7.0 0.0.0.255
deny ip 192.168.7.0 0.0.0.255 192.168.4.80 0.0.0.15
deny ip 192.168.5.0 0.0.0.255 192.168.4.80 0.0.0.15
deny ip 192.168.6.0 0.0.0.255 192.168.4.80 0.0.0.15
deny ip 192.168.3.0 0.0.0.255 192.168.4.80 0.0.0.15
deny ip 192.168.2.0 0.0.0.255 192.168.4.80 0.0.0.15
deny ip 192.168.4.80 0.0.0.15 any
deny ip 192.168.4.0 0.0.0.255 192.168.4.80 0.0.0.15
permit ip 192.168.4.0 0.0.0.255 any
permit ip host 172.20.1.2 any

[Alain Nohra]

ip nat inside source list NAT-Inside-Outside interface FastEthernet4 overload
ip nat inside source static tcp 192.168.4.117 7000 interface FastEthernet4 7000

route-map HDSL permit 10
match ip address NAT-Inside-Outside
match interface Vlan3

route-map CYBERIA permit 10
match ip address NAT-Inside-Outside
match interface FastEthernet4

[MHM Cisco World]

That not complete config

I will run lab and share steps of config 

[MHM Cisco World]

I try to run lab for your issue I face issue 

how you config the PBR for routing the traffic ??
can I  share the config 

[MHM Cisco World]

still waiting your reply 
the issue your PBR make return traffic different than enter point, 
this make Router build NAT entry but both telnet client and server not complete the TCP handshake. 
you must force the traffic via same point it enter. 
i.e.
route-map telnet permit 10
match ip address <ACL for telnet>
set ip next-hop <91.151.227.4x>

that it. 

but remember with this config you can only access internal via one ISP. 

[MHM Cisco World]

Sorry I run lab quickly, I have many other issue to solve, 
so take look how I config the R1 with route-map and static NAT for tcp telnet port 
thanks 
MHM  

upgrade fpd auto
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
!
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
track 1 ip sla 1 reachability
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.0.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map telnet
duplex half
!
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
!
interface FastEthernet2/0
ip address 100.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
!
interface FastEthernet2/1
no ip address
shutdown
duplex auto
speed auto
!
!
interface FastEthernet3/0
ip address 200.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
!
interface FastEthernet3/1
no ip address
shutdown
duplex auto
speed auto
!
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source route-map ISP1 interface FastEthernet2/0 overload
ip nat inside source route-map ISP2 interface FastEthernet3/0 overload
ip nat inside source static tcp 10.0.0.5 23 100.0.0.10 23 extendable
ip route 0.0.0.0 0.0.0.0 100.0.0.2 track 1
ip route 0.0.0.0 0.0.0.0 200.0.0.3 100
!
ip sla 1
icmp-echo 100.0.0.2 source-interface FastEthernet2/0
ip sla schedule 1 life forever start-time now
access-list 100 permit tcp host 10.0.0.5 eq telnet any
access-list 110 permit ip 10.0.0.0 0.0.0.255 any
no cdp log mismatch duplex
!
!
!
!
route-map telnet permit 10
match ip address 100
set ip next-hop 100.0.0.2
!
route-map telnet permit 20
match ip address 110
set ip default next-hop 200.0.0.3
!
route-map ISP2 permit 10
match ip address 110
match interface FastEthernet3/0
!
route-map ISP1 permit 10
match ip address 110
match interface FastEthernet2/0
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
mgcp behavior g729-variants static-pt
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
!
end

[Kanan Huseynli]

Hi,

do telnet on public IP and immediately check NAT table:

show ip nat trans | inc195.112.197.10:7000

In general, below should work and since it is plain static NAT, it is preferred over any others.

ip nat inside source static tcp 192.168.4.117 7000 195.112.197.10 7000 extendable

 By the way, did you try do delete NAT and re add? Sometimes static NAT stucks.

[Alain Nohra]

i did telnet and immediately checked NAT table: 

Pro Inside global Inside local Outside local Outside global
tcp 195.112.197.10:7000 192.168.4.117:7000 91.151.227.41:59002 91.151.227.41:59002

yes i did delete it and re add also i cleared the nat translations

[Kanan Huseynli]

Hi,

what is the system OS? If you can do, please enable wireshark or tcpdump to see does it really get packet or not.

Do you have firewall inside LAN? Since telnet from router works, there is no routing issue. But it can be blocked by firewall inside LAN/DC or your NAT stucked. You said, that you deleted and re-added, then there is one problem point - firewall inside NAT.

Verify that system gets packet or not.