cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
411
Views
15
Helpful
12
Replies
Highlighted
Beginner

Static PAT not working on ports 80 and 443

Hello, dear experts

 

I have a little bit of an issue with cisco static pat.

 

Basically i have some hosts on the remote network <site outside ip>, in the inside segment 10.0.0.0/8. Hosts need access to the internet and I need access to some ports from another remote location <my remote network>.

 

Point is - translations for ports 80 and 443 are not in the nat table. Other ports are translated. ip nat statistics have them counted.

 

What should i do to get them translated?

 

sh run:

interface GigabitEthernet0/0/0.101
ip address 10.10.1.254 255.255.255.0
ip nat inside

interface GigabitEthernet0/0/1
ip address <site outside ip> 255.255.255.0
ip nat outside

 

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload

 

ip access-list extended NAT
permit ip 10.10.1.0 0.0.0.255 any

ip access-list extended MYIP
permit ip any <my remote network> 0.0.0.255

route-map RM permit 20
match ip address MYIP

 

no ip http server
ip http authentication local
no ip http secure-server

 

sh ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp <site outside ip>:51089 10.10.1.10:3389 --- ---
tcp <site outside ip>:50880 10.10.1.3:8080 --- ---
tcp <site outside ip>:50322 10.10.1.3:22 --- ---
tcp <site outside ip>:50422 10.10.1.4:22 --- ---
tcp <site outside ip>:52089 10.10.1.20:3389 --- ---

 

sh ip nat statistics
Total active translations: 19 (8 static, 11 dynamic; 9 extended)

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Collaborator

Re: Static PAT not working on ports 80 and 443

Hi,

 

    1. The "extendable" keyword is not needed for your use-case, but it comes by default when you configure NAT entries, just leave it there; this keyword is used so that you're allowed to have an inside local address (10.10.10.10) to be visible on the outside via 2 different entities, 2 different global addresses (like both 20.20.20.20 and 30.30.30.30).

   2. "route-map" must be used with IOS NAT, whenever you want to configure policy NAT, be it static or dynamic; policy would mean that you want an inside host (10.10.10.10) to be visible on the outside differently, based on the accessed destination (like 10.10.10.10 gets NAT'ed into 20.20.20.20 if traffic destination is 100.100.100.100 and 10.10.10.10 dest NAT'ed into 30.30.30.30 if traffic destination is 150.150.150.150)

   2. The "reversible"keyword plays different roles depending on the NAT type; for static NAT, it enforces your policy static NAT to be bidirectional; static NAT is bidirectional by design, so this keyword enforces the policy to be bidirectional, not NAT. If you take the policy NAT example from point no. "2", it means the with reversible keyword, you force that traffic coming from the outside from 150.150.150.150 can only reach 10.10.10.10 by its outside IP of 30.30.30.30, and never by its other IP of 20.20.20.20; likewise only outside hosts of 100.100.100.100 can access 10.10.10.10 by its outside IP of 20.20.20.20.

 

As per you use-case, i made some corrections, to avoid weird behaviour. If you don't see the "80" and "443" entries in your NAT table, try to remove all your static policy NAT statements and put these first, from configuration standpoint. This has to work, if it doesn't, reload the router or upgrade (hopefully not the case).

 

ip access-list extended NAT
permit ip 10.10.1.0 0.0.0.255 any

!

ip access-list extended MYIP
no permit ip any <my remote network> 0.0.0.255

permit ip 10.10.1.0 0.0.0.255  <my remote network> 0.0.0.255

!

route-map RM permit 20
match ip address MYIP

 

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload

 

Regards,

Cristian Matei.

 

 

View solution in original post

12 REPLIES 12
Highlighted
VIP Mentor

Re: Static PAT not working on ports 80 and 443

Hello
When you have static nat then you don’t need to use the reversible keyword as the nat entry is static it isnt dynamic so the entry will always exist for bidirectional connection


As such you should not have no requirement for the route-map or reversible keywords unless that is I have mis-understood your query and you need make sure you connect externaly on the specific port youve defined in the static NAT 


Lastly you can negate the static hosts from the dynamic NAT access-list

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible

 

no ip access-list extended NAT

 

ip access-list extended NAT
deny ip host 10.10.1.3 any
deny ip host 10.10.1.4 any
deny ip host 10.10.1.10 any
deny ip host 10.10.1.20 any
permit ip 10.10.1.0 0.0.0.255 any

 



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Highlighted
Beginner

Re: Static PAT not working on ports 80 and 443

Hello Paul,

 

Thank you for your input!

 

Hosts 10.0.1.3, 1.0.1.4, etc have to have internet access, so I can't exclude them from dynamic pat.

 

extensible reversible is used for outside-to-inside initialization, so ports translated only when initiated from <my remote ip> network. The goal is to connect from <my remote ip> to specific hosts by the specific ports and prohibit external connection except initialized from <my remote ip>.

Highlighted
VIP Mentor

Re: Static PAT not working on ports 80 and 443

Hello


@IVoronov wrote:

extensible reversible is used for outside-to-inside initialization, so ports translated only when initiated from <my remote ip> network. The goal is to connect from <my remote ip> to specific hosts by the specific ports and prohibit external connection except initialized from <my remote ip>.


Not so sure i understand here, The reversible feature works as/when a internal host first initiates an external connection so from there on until the nat table is cleared you have a 1-1 host nat entry allowing external hosts to then initiate a outside/inside connection however is your case you already have that with the static pat entry’s.



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Highlighted
Beginner

Re: Static PAT not working on ports 80 and 443

Does it mean that "reversible" is used only on dynamic pat to create static translation? That's good to know, i appreciate your effort.

 

But in this particular case it means that this keyword is useless and can be omitted, because static rule does not need to be initialized from outside to create translation in nat table. I think i have to keep "extendable" so i can translate more than one internal ip address to one external? Or is it not needed for static pat?

 

And the problem stays: even if "reversible" does nothing for static pat entries, some of them (with ports 80 and 443) are not in the nat table but in nat counters for static translations.

Highlighted
VIP Mentor

Re: Static PAT not working on ports 80 and 443

Hello


@IVoronov wrote:

Does it mean that "reversible" is used only on dynamic pat to create static translation? That's good to know, i appreciate your effort.


My understanding it is yes.

Example: nat reversible
ip nat pool NATREV <first public-ip last public-ip> prefix-length x
ip nat inside source route-map NAT pool NATREV reversible

 

 


@IVoronov wrote:

But in this particular case it means that this keyword is useless and can be omitted, because static rule does not need to be initialized from outside to create translation in nat table. I think i have to keep "extendable" so i can translate more than one internal ip address to one external? Or is it not needed for static pat?


Correct

 

 

 


@IVoronov wrote:

And the problem stays: even if "reversible" does nothing for static pat entries, some of them (with ports 80 and 443) are not in the nat table but in nat counters for static translations.


If you clear the nat table than the only translation you should see is the static entrys that is however no other traffic is traversing the nat router at that time but if it is then you should see dynamic entrys also.



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Highlighted
Beginner

Re: Static PAT not working on ports 80 and 443

Hello Paul,

 

First of all, many thanks for your time, your help is invaluable for my little task.

 

I fixed the issue by removing "reversible" keyword and route-map, since it is useless for static translation in my case, because there is only 1:1 translation. I learned that route-map on static translation does not enforce any outside-inside security, because rule created has "---" as outside address so it is used for any outside-inside connections.

Security was fixed by adding acl to the inside interface.

 

I still have no idea why some of the static rules were in table and some are not, but this is for future lab testing.

 

Again, thank you for your time and effort, it helped greatly!

Highlighted
Collaborator

Re: Static PAT not working on ports 80 and 443

Hi,

 

   @IVoronov See my post, it does work with the reversible keyword, i mean enforcing your NAT policy so there is no need for an inbound ACL. Now as for the missing translations, if they showed up in config but not in the translation table, this was clearly a "feature", which could be fixed by some tweaking of the order of commands, a reload, or an upgrade.

 

Regards,

Cristian Matei.

Highlighted
Beginner

Re: Static PAT not working on ports 80 and 443

Hello Cristian,

 

I saw your post and greatly appreciate it. Now I understand that "reversible" was just useless in this particular case and may be omitted without consequences.

The point is that with only NAT policing is is kinda hard for me to do:

1) some predefined network <my remote ip> must have access to some inside hosts (10.10.1.0/24) on some ports. There static PAT is used

2) same hosts and some other in the same network have to have internet access. There dynamic PAT is used.

 

I don't think i can restrict outside access on some ports without impact on the internet access using only NAT policy tools, correct me if I'm wrong

Highlighted
VIP Mentor

Re: Static PAT not working on ports 80 and 443

Hello


@IVoronov wrote:
I fixed the issue by removing "reversible" keyword and route-map, since it is useless for static translation in my case, because there is only 1:1 translation. I learned that route-map on static translation does not enforce any outside-inside security, because rule created has "---" as outside address so it is used for any outside-inside connections.

Glad you got it working.

FYI as stated @Cristian Matei  the interface acl ingress acl isnt applicable, if you want to specify what external hosts can connect to those static public natted addresses ( something i didnt interpret you wanted on your OP so apologies) then the route-map with an acl can be used with (internal) to/from (external) networks being specifed to allow specific access.



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Highlighted
Collaborator

Re: Static PAT not working on ports 80 and 443

Hi,

 

    1. The "extendable" keyword is not needed for your use-case, but it comes by default when you configure NAT entries, just leave it there; this keyword is used so that you're allowed to have an inside local address (10.10.10.10) to be visible on the outside via 2 different entities, 2 different global addresses (like both 20.20.20.20 and 30.30.30.30).

   2. "route-map" must be used with IOS NAT, whenever you want to configure policy NAT, be it static or dynamic; policy would mean that you want an inside host (10.10.10.10) to be visible on the outside differently, based on the accessed destination (like 10.10.10.10 gets NAT'ed into 20.20.20.20 if traffic destination is 100.100.100.100 and 10.10.10.10 dest NAT'ed into 30.30.30.30 if traffic destination is 150.150.150.150)

   2. The "reversible"keyword plays different roles depending on the NAT type; for static NAT, it enforces your policy static NAT to be bidirectional; static NAT is bidirectional by design, so this keyword enforces the policy to be bidirectional, not NAT. If you take the policy NAT example from point no. "2", it means the with reversible keyword, you force that traffic coming from the outside from 150.150.150.150 can only reach 10.10.10.10 by its outside IP of 30.30.30.30, and never by its other IP of 20.20.20.20; likewise only outside hosts of 100.100.100.100 can access 10.10.10.10 by its outside IP of 20.20.20.20.

 

As per you use-case, i made some corrections, to avoid weird behaviour. If you don't see the "80" and "443" entries in your NAT table, try to remove all your static policy NAT statements and put these first, from configuration standpoint. This has to work, if it doesn't, reload the router or upgrade (hopefully not the case).

 

ip access-list extended NAT
permit ip 10.10.1.0 0.0.0.255 any

!

ip access-list extended MYIP
no permit ip any <my remote network> 0.0.0.255

permit ip 10.10.1.0 0.0.0.255  <my remote network> 0.0.0.255

!

route-map RM permit 20
match ip address MYIP

 

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload

 

Regards,

Cristian Matei.

 

 

View solution in original post

Highlighted
Beginner

Re: Static PAT not working on ports 80 and 443

Hello Cristian,

 

Thank you for the input!

 

Route-map was used in a bad way, cause no route policing is needed, that was a weak security enforcement attempt and I'm kinda ashamed of it, so i omitted it in the end.

Your description of the "reversible keyword" is actually great and i didn't found this at all, many thanks.

 

In the end i fixed the issue by removing route-maps and "reversible".

 

Still have no idea why 443 and 80 ports were not in nat table, will test it later on the lab.

Highlighted
Collaborator

Re: Static PAT not working on ports 80 and 443

Hi,

 

   I'm glad it's all clear now. If the commands were showing up in "running-config" for static NAT, but not in translations table, that's a bug which needs to be fixed by upgrade.

   As i said, even in your case, with using route-maps and reversible keyword, you still gain something (instead of using plain static NAT with no route-map and reversible): the fact that only remote networks defined in the ACL as destination IP, can initiate traffic towards your NAT'ed resources; otherwise a static NAT is just a static NAT, it's just available for everyone to access, unless you use an ACL to restrict that.

 

Regards,

Cristian Matei.