Can I do this without a static?

Unanswered Question
Apr 21st, 2009

We have two hosts inside of our network that makes a connection to a site on a non-standard port (1570). The site then sends traffic back to the host on the same port. Apparently, they couldn't get it to work for the return traffic unless they allowed the traffic back on the outside back in on the same port. This was in a symantec gateway appliance.

I'm doing my conversion, and I think it should work fine without allowing the traffic back in specifically, but if not, I think I'm going to have to have a static assigned for these hosts.

Any other suggestions?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Jon Marshall Tue, 04/21/2009 - 11:56


If the return traffic is part of the initiated connection outbound then no you should not need a static entry as long as you are Natting the traffic outbound whether that be dynamic NAT or PAT.


networker99 Wed, 04/22/2009 - 12:10

You will not need a static entry as PAT will perform the translation and the SPI will allow the traffic back though. Although the port information for each connection will be the same, the traffic will be differentiated by the IP address of the client.


This Discussion