Static PAT not working on ports 80 and 443

[IVoronov]

Hello, dear experts

I have a little bit of an issue with cisco static pat.

Basically i have some hosts on the remote network <site outside ip>, in the inside segment 10.0.0.0/8. Hosts need access to the internet and I need access to some ports from another remote location <my remote network>.

Point is - translations for ports 80 and 443 are not in the nat table. Other ports are translated. ip nat statistics have them counted.

What should i do to get them translated?

sh run:

interface GigabitEthernet0/0/0.101
ip address 10.10.1.254 255.255.255.0
ip nat inside

interface GigabitEthernet0/0/1
ip address <site outside ip> 255.255.255.0
ip nat outside

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload

ip access-list extended NAT
permit ip 10.10.1.0 0.0.0.255 any

ip access-list extended MYIP
permit ip any <my remote network> 0.0.0.255

route-map RM permit 20
match ip address MYIP

no ip http server
ip http authentication local
no ip http secure-server

sh ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp <site outside ip>:51089 10.10.1.10:3389 --- ---
tcp <site outside ip>:50880 10.10.1.3:8080 --- ---
tcp <site outside ip>:50322 10.10.1.3:22 --- ---
tcp <site outside ip>:50422 10.10.1.4:22 --- ---
tcp <site outside ip>:52089 10.10.1.20:3389 --- ---

sh ip nat statistics
Total active translations: 19 (8 static, 11 dynamic; 9 extended)

[paul driver]

Hello
When you have static nat then you don’t need to use the reversible keyword as the nat entry is static it isnt dynamic so the entry will always exist for bidirectional connection

As such you should not have no requirement for the route-map or reversible keywords unless that is I have mis-understood your query and you need make sure you connect externaly on the specific port youve defined in the static NAT 

Lastly you can negate the static hosts from the dynamic NAT access-list

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible

no ip access-list extended NAT

ip access-list extended NAT
deny ip host 10.10.1.3 any
deny ip host 10.10.1.4 any
deny ip host 10.10.1.10 any
deny ip host 10.10.1.20 any
permit ip 10.10.1.0 0.0.0.255 any

[IVoronov]

Hello Paul,

Thank you for your input!

Hosts 10.0.1.3, 1.0.1.4, etc have to have internet access, so I can't exclude them from dynamic pat.

extensible reversible is used for outside-to-inside initialization, so ports translated only when initiated from <my remote ip> network. The goal is to connect from <my remote ip> to specific hosts by the specific ports and prohibit external connection except initialized from <my remote ip>.

[paul driver]

Hello

---

@IVoronov wrote:

extensible reversible is used for outside-to-inside initialization, so ports translated only when initiated from <my remote ip> network. The goal is to connect from <my remote ip> to specific hosts by the specific ports and prohibit external connection except initialized from <my remote ip>.

---

Not so sure i understand here, The reversible feature works as/when a internal host first initiates an external connection so from there on until the nat table is cleared you have a 1-1 host nat entry allowing external hosts to then initiate a outside/inside connection however is your case you already have that with the static pat entry’s.

[IVoronov]

Does it mean that "reversible" is used only on dynamic pat to create static translation? That's good to know, i appreciate your effort.

But in this particular case it means that this keyword is useless and can be omitted, because static rule does not need to be initialized from outside to create translation in nat table. I think i have to keep "extendable" so i can translate more than one internal ip address to one external? Or is it not needed for static pat?

And the problem stays: even if "reversible" does nothing for static pat entries, some of them (with ports 80 and 443) are not in the nat table but in nat counters for static translations.

[paul driver]

Hello

---

@IVoronov wrote:

Does it mean that "reversible" is used only on dynamic pat to create static translation? That's good to know, i appreciate your effort.

---

My understanding it is yes.

Example: nat reversible
ip nat pool NATREV <first public-ip last public-ip> prefix-length x
ip nat inside source route-map NAT pool NATREV reversible

---

@IVoronov wrote:

But in this particular case it means that this keyword is useless and can be omitted, because static rule does not need to be initialized from outside to create translation in nat table. I think i have to keep "extendable" so i can translate more than one internal ip address to one external? Or is it not needed for static pat?

---

Correct

---

@IVoronov wrote:

And the problem stays: even if "reversible" does nothing for static pat entries, some of them (with ports 80 and 443) are not in the nat table but in nat counters for static translations.

---

If you clear the nat table than the only translation you should see is the static entrys that is however no other traffic is traversing the nat router at that time but if it is then you should see dynamic entrys also.

[IVoronov]

Hello Paul,

First of all, many thanks for your time, your help is invaluable for my little task.

I fixed the issue by removing "reversible" keyword and route-map, since it is useless for static translation in my case, because there is only 1:1 translation. I learned that route-map on static translation does not enforce any outside-inside security, because rule created has "---" as outside address so it is used for any outside-inside connections.

Security was fixed by adding acl to the inside interface.

I still have no idea why some of the static rules were in table and some are not, but this is for future lab testing.

Again, thank you for your time and effort, it helped greatly!

[Cristian Matei]

Hi,

   @IVoronov See my post, it does work with the reversible keyword, i mean enforcing your NAT policy so there is no need for an inbound ACL. Now as for the missing translations, if they showed up in config but not in the translation table, this was clearly a "feature", which could be fixed by some tweaking of the order of commands, a reload, or an upgrade.

Regards,

Cristian Matei.

[IVoronov]

Hello Cristian,

I saw your post and greatly appreciate it. Now I understand that "reversible" was just useless in this particular case and may be omitted without consequences.

The point is that with only NAT policing is is kinda hard for me to do:

1) some predefined network <my remote ip> must have access to some inside hosts (10.10.1.0/24) on some ports. There static PAT is used

2) same hosts and some other in the same network have to have internet access. There dynamic PAT is used.

I don't think i can restrict outside access on some ports without impact on the internet access using only NAT policy tools, correct me if I'm wrong

[paul driver]

Hello

---

@IVoronov wrote:
I fixed the issue by removing "reversible" keyword and route-map, since it is useless for static translation in my case, because there is only 1:1 translation. I learned that route-map on static translation does not enforce any outside-inside security, because rule created has "---" as outside address so it is used for any outside-inside connections.

---

Glad you got it working.

FYI as stated @Cristian Matei  the interface acl ingress acl isnt applicable, if you want to specify what external hosts can connect to those static public natted addresses ( something i didnt interpret you wanted on your OP so apologies) then the route-map with an acl can be used with (internal) to/from (external) networks being specifed to allow specific access.

[Cristian Matei · Accepted solution]

Hi,

    1. The "extendable" keyword is not needed for your use-case, but it comes by default when you configure NAT entries, just leave it there; this keyword is used so that you're allowed to have an inside local address (10.10.10.10) to be visible on the outside via 2 different entities, 2 different global addresses (like both 20.20.20.20 and 30.30.30.30).

   2. "route-map" must be used with IOS NAT, whenever you want to configure policy NAT, be it static or dynamic; policy would mean that you want an inside host (10.10.10.10) to be visible on the outside differently, based on the accessed destination (like 10.10.10.10 gets NAT'ed into 20.20.20.20 if traffic destination is 100.100.100.100 and 10.10.10.10 dest NAT'ed into 30.30.30.30 if traffic destination is 150.150.150.150)

   2. The "reversible"keyword plays different roles depending on the NAT type; for static NAT, it enforces your policy static NAT to be bidirectional; static NAT is bidirectional by design, so this keyword enforces the policy to be bidirectional, not NAT. If you take the policy NAT example from point no. "2", it means the with reversible keyword, you force that traffic coming from the outside from 150.150.150.150 can only reach 10.10.10.10 by its outside IP of 30.30.30.30, and never by its other IP of 20.20.20.20; likewise only outside hosts of 100.100.100.100 can access 10.10.10.10 by its outside IP of 20.20.20.20.

As per you use-case, i made some corrections, to avoid weird behaviour. If you don't see the "80" and "443" entries in your NAT table, try to remove all your static policy NAT statements and put these first, from configuration standpoint. This has to work, if it doesn't, reload the router or upgrade (hopefully not the case).

ip access-list extended NAT
permit ip 10.10.1.0 0.0.0.255 any

!

ip access-list extended MYIP
no permit ip any <my remote network> 0.0.0.255

permit ip 10.10.1.0 0.0.0.255  <my remote network> 0.0.0.255

!

route-map RM permit 20
match ip address MYIP

ip nat inside source static tcp 10.10.1.3 22 <site outside ip> 50322 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 80 <site outside ip> 50380 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 22 <site outside ip> 50422 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 443 <site outside ip> 50443 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.4 80 <site outside ip> 50480 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.3 8080 <site outside ip> 50880 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.10 3389 <site outside ip> 51089 route-map RM extendable reversible
ip nat inside source static tcp 10.10.1.20 3389 <site outside ip> 52089 route-map RM extendable reversible
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload

Regards,

Cristian Matei.

[IVoronov]

Hello Cristian,

Thank you for the input!

Route-map was used in a bad way, cause no route policing is needed, that was a weak security enforcement attempt and I'm kinda ashamed of it, so i omitted it in the end.

Your description of the "reversible keyword" is actually great and i didn't found this at all, many thanks.

In the end i fixed the issue by removing route-maps and "reversible".

Still have no idea why 443 and 80 ports were not in nat table, will test it later on the lab.

[Cristian Matei]

Hi,

   I'm glad it's all clear now. If the commands were showing up in "running-config" for static NAT, but not in translations table, that's a bug which needs to be fixed by upgrade.

   As i said, even in your case, with using route-maps and reversible keyword, you still gain something (instead of using plain static NAT with no route-map and reversible): the fact that only remote networks defined in the ACL as destination IP, can initiate traffic towards your NAT'ed resources; otherwise a static NAT is just a static NAT, it's just available for everyone to access, unless you use an ACL to restrict that.

Regards,

Cristian Matei.

[lakhwaraa]

After viewing this thread , i have a question of my own

interface GigabitEthernet0/1
ip address 120.124.32.5 255.255.255.248
ip mtu 1492
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!

interface Vlan1
ip address 10.20.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
no ip http server
ip http port 8080
ip http secure-server

ip nat inside source list mynat interface GigabitEthernet0/1 overload
ip nat inside source static tcp 10.20.1.12 443 interface GigabitEthernet0/1 443

ip nat outside source list NAT-OUT-IN pool POOL-OUT-IN
ip route 10.20.0.0 255.255.255.0 10.20.1.249 (10.20.1.249 is my layer 3 switch)
ip route 192.168.20.0 255.255.255.0 10.20.1.249
ip tacacs source-interface Vlan1
!

ip access-list extended GigabitEthernet0/1
permit tcp any host 202.147.165.4 eq 443
permit tcp host 202.147.165.4 eq 443 any

ip access-list extended NAT-OUT-IN
permit tcp any host 202.147.165.4 eq 443
permit tcp host 202.147.165.4 eq 443 any

ip access-list extended firewall (This acl was empty, i put the entry for 207.67.74.157)
permit tcp any host 202.147.165.4 eq 443
permit tcp host 202.147.165.4 eq 443 any

ip access-list extended mynat

permit ip 10.20.1.0 0.0.0.255 any
permit ip 192.168.20.0 0.0.0.255 any
permit tcp any host 202.147.165.4 eq 443
permit tcp host 202.147.165.4 eq 443 any
!

My remote location ip is 202.147.165.4 and it has blocked all traffice except 443
i am unable to ping or trace route 202.147.165.4 port 443.
i have put remote ip entries in all over router but of no use
any help