Hi, I'm pretty new to IOS configuration and am having some difficulties mapping some external ports to hosts on the inside of the network. I have gone through the steps that I expected would work and the hosts on the inside of the network can connect to the outside world and the results of internal to external mappings are present as expected while viewing the debug information. What is also interesting, as depicted here, is that the static mappings are showing in the transactions table: tcp 1XX.1XX.1XX.1XX:19770  2YY.2YY.2YY:3389    ---                   --- These are as configured. When I attempt to connect to the address using the external port I am not seeing any evidence in the logs that point to the attempted translation being made. Here is my complete config: version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname broute1 ! boot-start-marker boot-end-marker ! ! logging buffered 65535 logging console informational ! no aaa new-model ! memory-size iomem 10 clock timezone ESTime 10 0 crypto pki token default removal timeout 0 ! ! ip source-route ! ! ! ! ! ip cef no ip bootp server ip domain name ninterface.com ip name-server IPADDRESS DNS ip name-server IPADDRESS DNS ip inspect name CBAC appleqtc ip inspect name CBAC dns ip inspect name CBAC esmtp ip inspect name CBAC http ip inspect name CBAC https ip inspect name CBAC ftp ip inspect name CBAC h323 ip inspect name CBAC isakmp ip inspect name CBAC l2tp ip inspect name CBAC icmp ip inspect name CBAC imap ip inspect name CBAC imaps ip inspect name CBAC ftps ip inspect name CBAC ntp ip inspect name CBAC sip ip inspect name CBAC sip-tls ip inspect name CBAC ssh ip inspect name CBAC tcp ip inspect name CBAC udp login block-for 300 attempts 4 within 60 login delay 7 login quiet-mode access-class aclQuietMode login on-failure log no ipv6 cef ! ! multilink bundle-name authenticated license udi pid CISCO887VA-SEC-K9 sn XXXXXXXXXX ! ! archive log config   hidekeys username PERSON privilege 15 secret 4 BLAHBLAH ! ! ! ! controller VDSL 0 operating mode adsl2 annex A ! ip ssh version 2 ! ! ! ! ! ! ! interface Loopback0 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 description --- Internode ADSL ---- no ip address no ip route-cache load-interval 30 no atm ilmi-keepalive ! interface ATM0.1 point-to-point no ip route-cache pvc 8/35   tx-ring-limit 3   encapsulation aal5snap   pppoe-client dial-pool-number 1 ! ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 description Management Interface ip address INTERNALADDRESS 255.255.255.0 ip nat inside ip virtual-reassembly in no ip route-cache cef ip tcp adjust-mss 1420 ! interface Dialer0 no ip address ip virtual-reassembly in shutdown no cdp enable ! interface Dialer1 description -----INTERNODE ADSL------ mtu 1492 ip address negotiated ip access-group 103 in no ip redirects no ip unreachables no ip proxy-arp ip mtu 1460 ip nat outside ip inspect CBAC out ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1 ppp chap hostname INTERNETUSERNAME ppp chap password 7 INTERNETPASSWORD ppp ipcp dns request accept no cdp enable ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip dns server ip dns server ip nat inside source static tcp 2YY.2YY.2YY 3389 interface Dialer1 19770 ip nat inside source static tcp 2YY.2YY.2YY 22 interface Dialer1 19771 ip nat inside source static tcp 2YY.2YY.2YY 5000 interface Dialer1 5000 ip nat inside source static tcp 2YY.2YY.2YY873 interface Dialer1 873 ip nat inside source static tcp 2YY.2YY.2YY 3389 interface Dialer1 31313 ip nat inside source static tcp 2YY.2YY.2YY 3389 interface Dialer1 19450 ip nat inside source list NAT-ACL interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list standard acINAT ip access-list standard aclQuietMode permit INTERNALRANGE 0.0.0.255 ! ip access-list extended NAT-ACL permit ip INTERNALRANGE  0.0.0.255 any ip access-list extended aclNat permit ip INTERNALRANGE 0.0.0.255 any ! logging trap debugging access-list 43 permit INTERNALRANGE  0.0.0.255 access-list 103 permit tcp host 0.0.0.0 host STATICGLOBAL eq EX-PORT access-list 103 permit icmp any any dialer-list 1 protocol ip permit no cdp run ! ! ! ! route-map rmNatIn2Out permit 10 match ip address aclNat ! ! control-plane ! alias exec t10 term len 0 alias exec ps show process cpu alias exec top show process cpu sort 5m | exc1 (0.00% 0.00% 0.00%) alias exec version show version | include image alias exec uptime show version | include uptime|ROM[^:]|restarted alias exec hist show process cpu history ! line con 0 login local transport output ssh line aux 0 transport output all line vty 0 2 access-class aclNat in exec-timeout 20 0 privilege level 15 login local transport input ssh line vty 3 4 access-class aclQuietMode in exec-timeout 20 0 privilege level 15 login local transport input ssh ! scheduler max-task-time 5000 sntp server 192.231.203.132 end Yep its a terrible hackjob and I am sure there are a few commands that dont belong any more but I'm perplexed as to what I have missed. Can anyone help point me in the right direction? Thanks! Bruno ... View more