Users are connecting with RDP from the LAN side of the router to a remote data center. No one is trying to RDP in through this router. A user creates an RDP connection and while in that connection tries to go to the static web NAT but fails.

If I do that then I won't be able to establish the VPN to 63.123.252.12 via the internet interface.

Your NAT with the RDP server matches your first NAT statement and it is overloading to a WAN2 address. It also matches the more specific static translation, but will never see it since NAT goes top to bottom and matches the first route map.

To fix you can deny the specific RDP server IP on the first route map, then permit the whole network in order to reach the below static nat statement on port 80

It also looks like your 80 static nat entry is referring to source port and not destination port.

You may want to create a separate route-map for the RDP server in order to crate an extended access list for any destination to port 80

I changed the ACL for the first route map to what is below but it still fails.

ip access-list extended Internet

deny ip 172.18.127.0 0.0.0.255 host 63.123.252.123

deny ip 172.18.127.0 0.0.0.255 10.11.0.0 0.0.255.255

permit ip 172.18.127.0 0.0.0.255 any

permit ip 192.168.2.0 0.0.0.255 any

The static NAT to the web server is working from everywhere but within the RDP connection.

Can you post your updated config as well?

here it is - only one ACL has changed

Why wouldn't traffic for 63.123.252.123 match the route "ip route 63.123.252.0 255.255.255.0 WAN1.WAN1.WAN1.41," even if it comes after the default route? Shouldn't the router look for the most specific route and use it, regardless of where it is in the config?

Here is a trace from the router to the RDP server. The router is putting the traffic out the correct interface.

gem-nj_gem#trace

Protocol [ip]:

Target IP address: 63.123.252.123

Source address: 172.18.127.1

Numeric display [n]:

Timeout in seconds [3]:

Probe count [3]:

Minimum Time to Live [1]:

Maximum Time to Live [30]:

Port Number [33434]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Type escape sequence to abort.

Tracing the route to 63.123.252.123

1 ool-60381e29.static.optonline.net (WAN1.WAN1.WAN1.41) 0 msec 4 msec 0 msec

no ip nat inside source static tcp 172.18.127.10 80 WAN1.WAN1.WAN1.42 80 extendable

no ip nat inside source static tcp 172.18.127.41 2500 WAN1.WAN1.WAN1.42 2500 extendable

no ip nat inside source static tcp 172.18.127.42 3001 WAN1.WAN1.WAN1.42 3001 extendable

no ip nat inside source static tcp 172.18.127.48 2500 WAN1.WAN1.WAN1.42 5001 extendable

no ip nat inside source static tcp 172.18.127.49 2500 WAN1.WAN1.WAN1.42 8192 extendable

ip nat inside source static tcp 172.18.127.10 80 interface FastEthernet4 80 extendable

ip nat inside source static tcp 172.18.127.41 2500 interface FastEthernet4 2500 extendable

ip nat inside source static tcp 172.18.127.42 3001 interface FastEthernet4 3001 extendable

ip nat inside source static tcp 172.18.127.48 2500 interface FastEthernet4 5001 extendable

ip nat inside source static tcp 172.18.127.49 2500 interface FastEthernet4 8192 extendable

All of those NAT statements I have in the router work fine from outside of the RDP session. What is the benefit to pointing them to the interface name rather than the interface's IP? Yesterday I tried your suggestion with the 172.18.127.10 NAT and the result was the same - I can reach it from outside the RDP session but not inside.