Nat Ports Inaccessible via site-to-site VPN

[Justin Kroll]

We have an ISR 2900 series at HQ and several Cisco WRVS4400N VPN routers at small branch offices. The branch offices are connected to HQ via site-to-site IPSec. Everything seems to work fine, except users in the branch offices can not access any services on HQ servers where the port has been NAT'd to the outside. For example, we run remote desktop services over https, port 443 is NAT'd to the outside, but users in the branch offices can not access this port. They receive a timeout error. I've tried searching, but all I can find is info on running IPSec through NAT. Thanks...

[Michael Muenz]

Probably the access-list for NAT on the ISR doesn't exclude the network ranges of the offices?

[Justin Kroll]

I believe the ACL is set properly. Normal connectivity works, it's just forwarded ports that do not.

HQ subnet is 10.0.0.0/24, one branch is 10.0.1.0/24

Here's the applicable lines of the config:

ip nat inside source route-map SDM_RMAP_3 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 10.0.0.11 443 xxx.xxx.xxx.165 443 extendable

route-map SDM_RMAP_3 permit 1
 match ip address 110
 match interface GigabitEthernet0/1

access-list 110 deny   ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255
access-list 110 permit ip 10.0.0.0 0.0.0.255 any

[Karsten Iwen · Accepted solution]

With this NAT-config, your router enforces that the internal server has to be accessed by the public IP. You can add a route-map to your static NAT entry to exempt the VPN-traffic from NAT. That could look like the following:

ip nat inside source static tcp 10.0.0.11 443 xxx.xxx.xxx.165 443 route-map SERVER-NAT extendable
!
ip access-list extended SERVER-NAT-ACL
 deny ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
 permit ip any any
!
route-map SERVER-NAT permit 10
 match ip address SERVER-NAT-ACL

[Justin Kroll]

Perfect! I did not realize interface route-maps don't apply to static NAT. Thanks!