Static NAT, Dynamic NAT & Concurrent Routing

Unanswered Question
Sep 5th, 2007

Company A & B merged. Company A has Server Farm as address space. Company B has Server Farm as space. However Company B's remote Sites fall within the space. Company A & B are connected using VPN tunnel. Company B's remote site use this VPN tunnel (remote site >>mpls >> company B rtr >> firewall).

Short term goal is to have Company B's remote site access A's Server Farm (traffic will only be flowing from remote sites to Servers and never in reverse).

Solution I have proposed is to have a NAT router sitting at Company A site b/w the server farm and Firewall.

1. All traffic b/w "B" Server farm and "A" server farm not Natted. All traffic between B's remote will be source NATTed to space and all A's destinations will appear at these remote sites (using the NAT router) as (Static 1 to 1 NATs). Does anyone see any issues with this setup, considering the NAT router in question will be doing static NAT as well as routing.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Thu, 09/06/2007 - 12:51


No i don't see any problem with what you are proposing but could you not set this nat up on the firewall rather than insert a router ?


htaluja_2 Thu, 09/06/2007 - 12:55

Hi Jon,

That is easier said than done. Multiple firewall technologies including windows (dont ask) have been utilized. Objective is have users throughout this merged entity have faster access to internal resources as well as encourage consolidation. The key question here is if an interface is marked ip nat inside and another ip nat outside, could I have still have routing of NON-NATTED subnets through this router. In other words does the ip nat inside/outside command mandate that all traffic through is either natted or dropped? Thanks much!

Jon Marshall Thu, 09/06/2007 - 13:20


Apologies as i didn't fully understand what you were proposing - my fault.

I think you will have problems with the static translations in that if you set up static translations all devices at the remote end would need to refer to the natted addresses.

You can do conditional NAT with route-maps but only for dynamic NAT as far as i know.

The only thing i can think of is that you need to only go through the router if you are routing to the Natted addresses. if you want to go direct to the real addresses you bypass the router. But i don't know how easy that would be with your topology.


htaluja_2 Thu, 09/06/2007 - 13:23

As far as conditional NATTing is concerned, I think the following command does conditional NAT for static:

ip nat inside source static REAL VIRTUAL route-map1


ip nat inside source static REAL VIRTUAL


Let me know.


htaluja_2 Thu, 09/06/2007 - 13:29

One final request regarding the same. Could you also find out about the concurrent routing i.e. static nat with route-map stating that this nat applies for only certain source and destinations (using specific deny statement first and general permit following that) and then routing b/w inside and outside b/w internal subnet and the networks in the deny statement.

Many Thanks!

Jon Marshall Fri, 09/07/2007 - 19:48


Apologies for delay in replying, we had a bit of an emergency at work :)

I tested this out and it looks like you should be fine. I set up a server behind a router and did a static NAT entry for it with a route-map spsecifying the source IP addresses.

Then from one of the source IP addresses i could ping the natted address.

Then from a different source IP address that was not included in the route-map i pinged the real address and this worked also.

So from a lab environment it looks like you can do what you are proposing.

Could you explain your second query again ?


htaluja_2 Sun, 09/09/2007 - 17:02


(firewall edited config attached))

In order to complete the aforementioned design, I need the PIX firewall do the following (example subnets: NYC is; Boston Hub: & Boston Remote Sites (note that Boston remotes are connected to boston hub using an internal mpls network. these remotes connect to nyc using the vpn connection b/w boston pix and nyc firewall :

NAT all traffic hitting the inside interface of the Boston PIX so that:

traffic going to NYC from Boston Hub is not natted. traffic entering the pix from any boston remote sites and destined for nyc hub is natted to address space.

We have to make sure, as well, that traffic originating from NYC to subnet should work fine.

Please take a look and let me know.


This Discussion