Hello,
In my personal opinion, these two statements should not conflict.
The first statement establishes a static translation entry in the NAT table with the correspondence
192.168.1.18:3389 <---> 24.x.y.234:3389
Every time a packet appears going to IP:TCP port 24.x.y.234:3389, it will be immediately translated to 192.168.1.18:3389, and vice versa. The IOS should not go through dynamic NAT/PAT entries because the static entry for this traffic will always be present and found in the NAT table, not requiring the IOS to ever generate a dynamic mapping.
The second statement actually establishes a conditional translation entry. A translation will be performed only if the route-map conditions are both met:
- the traffic must be permitted by the ACL 100, and
- the traffic must be routed out the interface E1/0
You could say it is a kind of NAT Exemption, but for a different global (public) IP address.
If you configure both these statements in a router, the show ip nat translation will show you this:
R1(config)#do show ip nat tran
Pro Inside global Inside local Outside local Outside global
tcp 24.1.2.234:3389 192.168.1.18:3389 --- ---
--- 24.1.2.235 192.168.1.18 --- ---
R1(config)#
Note that both entries are prepared in the NAT tables as sorts of templates. The actual packet going through this NAT table will either find a complete entry for its source/destination IP/protocol/port, or will hit the template translation entry and a new specific record will be created for it.
My unwarranted assumption here is that always the best match is used, i.e. if the packet is TCP/192.168.1.18:3389, it will be handled by the first entry and not by the second one. In any case, you can always remove this doubts - and this is what I recommend - by having the NAT configurations explicitly apply to disjoint traffic. In your case, the ACL 100 should be prepended a line saying:
access-list 100 deny tcp host 192.168.1.18 eq 3389 any
This will make the route-map based translation to never apply to the static PAT entry.
Best regards,
Peter
