Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Dual NAT construct, problems from outside to inside

Dear Experts,

I have a problem using 2 different NATs. Please have a look at the attached topology.

Users at the Branch need local internet access. That's why an overload NAT is configured on the interface Fa0/0 (connected to the Internet):


access-list 150 deny   ip

access-list 150 deny   ip

access-list 150 deny   ip

access-list 150 permit ip any

route-map NAT-INET-RM permit 10

match ip address 150

ip nat inside source route-map NAT-INET-RM interface FastEthernet0/0 overload

interface FastEthernet0/1

ip nat inside

interface FastEthernet0/0

ip nat outside

Additionally I need to masquerade the Branch LAN behind, because the is already used in the Headquarter:


access-list 151 permit ip

access-list 151 permit ip

access-list 151 permit ip

route-map NAT-VPN-RM permit 10

match ip address 151

ip nat pool NAT-VPN-POOL prefix-length 24 type match-host

ip nat inside source route-map NAT-VPN-RM pool NAT-VPN-POOL reversible

interface Tunnel1

ip nat outside

This setup works fine in general. The only problem is, that NAT entries are only generated, when traffic comes from the Branch hosts. If a host from the HQ network tries to initiate a session with the Branch server, and no NAT entry is existing yet, the router does not generate a new NAT entry. The router only generates a new entry, when traffic is initiated from the inside (from the Branch LAN).

I already tried to implement an additional static NAT entry for the server like


ip nat inside source static

but this didn't work either. The router generates a simple static NAT entry, but when I ping from the HQ, I see the ICMP request get's NATed, but the reply doesn't.

Can anyone give me a hint?

What does the "reversible" do exactly?


Everyone's tags (2)