Site to Site VPN and Port Forward

Unanswered Question
Sep 1st, 2008
User Badges:



I have 10 sites using 877's, latest IOS 12.4.T, and all are in a mesh configuration.

Each site also has a port forward rule SMTP rule from the internet to the local Exchange 2007 server.


My issue is that if I telnet to port 25 on an Exchange server in a different site the connection fails due to some sort of conflict with the remote port forward rule. Remove the port forward rule in the remote site and the connection works.

Is there anyway around this problem?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Marwan ALshawi Mon, 09/01/2008 - 07:26
User Badges:
  • Purple, 4500 points or more
  • Community Spotlight Award,

    Best Publication, December 2015

make aditional line for port forwarding

like maping port 250 to internal 25

inotherwords play with ports to avoid conflcting

apstownsend Mon, 09/01/2008 - 07:57
User Badges:

Thanks for the reply.

If I map 25 outside to 25000 internal the server doesn't respond!

Is there anyway of doing this without changing ports etc?

jpoplawski Tue, 09/02/2008 - 13:11
User Badges:
  • Bronze, 100 points or more

We ran into this situation with Site to Site VPN's and Static NAT entries. The router is attempting to "un-nat" the VPN-ed traffic and push it back to the outside interface NAT translation. Here's what I did to overcome it.

Setup a Loopback Interface:

interface Loopback0

ip address

Create an ACL for the traffic to go backwards:

access-list 177 permit ip host

where = local server

Where = remote subnet (perhaps your HQ)

Create Policy Based Routing

route-map PBR permit 10

match ip address 177

set ip next-hop

Apply PBR to inside interface

interface Vlan1

ip policy route-map PBR

This effectively tells the router to use the loopback to go through the tunnel, instead of using the outside NAT translation.

My explanation could probably be better explained, but I know this works from previous experience. You will obviously have to modify the config to meet your needs.

A different approach to overcome this issue can be found here:

Cheers, rate me if this helps!



This Discussion