Indeed, I do need static one-to-one mapping so that outside host (from 172.30.10.0/24) can access the internal host (182.168.1.0/24) via the nat'd outside address (172.30.11.0/24).

Zhen

Sorry i didn't explain it properly. Even though you want a one to one mapping you are still dynamically allocating them as needed ie. until traffic passes through the router the NAT translation is not there and after a period of inactivity the translation is removed.

Jon

Hello Jon and Zhenxu

I will revive this thread because I have similar if not the same problem. (policy NAT on IOS)

Inside LAN: 10.136.96.0/20

The inside LAN address should be NAT'd to 10.108.96.0/20 ONLY if the traffic is going to 10.203.208.0/24.

But I need it to work both ways.

I am able to make it work with sessions initiated in one direction (from 10.136.96.x to 10.203.208.y), but not both directions. ( 10.203.208.0/24 to 10.108.96.0/20 as well)

ip access-list extended NAT-A-B
 permit ip 10.136.96.0 0.0.15.255 10.203.208.0 0.0.0.255

route-map rm-nat permit 10
 match ip address NAT-A-B

ip nat pool net-x 10.108.96.0 10.108.111.255 prefix-length 20 type match-host

ip nat inside source route-map rm-nat pool net-x

I tried to do it with ACLs and it worked the same way(one way).

I tried to add ip nat inside destination with similar logic, but that caused the condition to be neglected

and all traffic from 10.136.96.0/20 ended up translated.

I tried to use reversible option on top of using route-map scenario, but that only creates general entry in the NAT table for specific entries created in the first step.

so e.g. if I do ping from SA:10.136.96.8 to DA:10.203.208.1, the router correctly translates it to SA:10.108.96.8 DA:10.203.208.1 and I am able to ping in the opposite direction - from 10.203.208.1 to 10.108.96.8.

But I can not initiate session from 10.203.208.1 to anything else than 10.108.96.8.

So "reversible" is not ment as remedy for this situation.

I do not have option "route-map" available in "ip nat static network A B /X"which would be the simpliest scenario if it was working.

please help on how to do this if possible.

Thank you

Leo

Hi Leo,

The reverse ping from 10.203.208.1 to 10.108.96.8 was working because it was already presented in NAT translation table due to your initial ping (SA:10.136.96.8 to DA:10.203.208.1) hits the routemap and trigerred NAT.

The reason it was not pinging from 10.203.208.1 to anything else is that, there is no translation for other destination apart from 10.108.96.8 in NAT table so far.

Note: For dynamic NAT inside, the traffic should be initiated from inside to outside. Not from outside to inside.