Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ip nat static stops working - dynamic continues to work

I have a customer using a 3600 Cisco router w/12.1 IOS. I have a static nat setup for the mail server for ports 25, 110, and port 80 for OWA.

We reload/reboot the router and everything works fine. After about 3hrs the mail server can no longer access the internet outbound. It can still receive email but all outbound mail queues on the server. The server can not resolve DNS queries, or any outbound access.

Here is my ip nat commands:

ip nat inside source static tcp xxx.xxx.xxx.xxx 25 xxx.xxx.xxx.xxx 25 extendable

(same for ports 110 and 80).

ip nat inside (assigned to e0)

all users are setup to use the ip nat pool dynamic...this works even after the static nat stops working.

Anyone give me a idea of what to look at. It use to work all of the time. Now it is intermittent only for the mail server (static nat).

Thanks, jamie

5 REPLIES
New Member

Re: ip nat static stops working - dynamic continues to work

Hello !

What does the "debug ip nat" command show when you have the problem ?

/ BR Daniel

New Member

Re: ip nat static stops working - dynamic continues to work

have not ran the statement/command? will do next time I have the problem

New Member

Re: ip nat static stops working - dynamic continues to work

Where is your DNS server? I'm assuming it is the same box oas the mail server. I would start by looking at the dynamic table (show ip nat trans) when dns stops working. Since mail uses so many dns lookups, I would think you might be filling the table with dynamic translations for port 53. I don't know what the default limit is, I believe it's somewhere around 1000 but that can be changed with the following commands:

ip nat translation timeout

ip nat translation tcp-timeout

ip nat translation udp-timeout

ip nat translation dns-timeout

ip nat translation icmp-timeout

The other option may be to put an extendable static nat on port 53 tcp and 53 udp. Not sure if you want to do that, but it might limit the number of assignments from the dynamic pool.

New Member

Re: ip nat static stops working - dynamic continues to work

I added ip nat translation timeout 30 - seemed to have no affect. My dynamic nat sessions continue to run, users are able to browse and do dns quieries from the workstations. It is only my static map for my mail server outbound that stops working? Everything stops for the static map outbound, ftp, dns, http, telnet.... and only outbound?!

It is almost like the router runs out of memory for use with the static nat?

New Member

Re: ip nat static stops working - dynamic continues to work

Hi,

Is the DNS Machine different from the mail Server system? You can do one thing and test apart from tcp port use ip nat inside outside for udp also for both the mail server and dns server by opening port 25 and port 53. You can also try creating access-list for the two statically mapped machines denying them to in the part of the pool of dynamically allocated ip addresses. These are some of my suggestions. You can also check your dns resolution.

178
Views
0
Helpful
5
Replies
CreatePlease to create content