Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a DMZ type environment between two internal networks using Cisco NAT. The below configuration is working to permit the two 'nat outside' interfaces to access the dmz 'nat inside' server via the & hide nat IP addresses. However the server ( is not being nat'd when it accesses the other two devices.

I need this to bi-directionally nat in order to hide the 'nat inside' network. For instance, is able to ping/telnet to and access the device and is successfully translated. However, when telnets to the traffic shows up with the original ip address and not the desired address.

interface GigabitEthernet0/0
 description insidetrusted
 ip address
 ip nat outside
interface GigabitEthernet0/1
 description dmz
 ip address
 ip nat inside
interface GigabitEthernet0/2
 description outside
 ip address
 ip nat outside
ip nat inside source static route-map netoutside
ip nat inside source static route-map netinside

route-map netoutside permit 10
 match ip address 101
 match interface GigabitEthernet0/2
route-map netinside permit 10
 match ip address 100
 match interface GigabitEthernet0/0

Resources I've used in my research:

share|improve this question
up vote 1 down vote accepted

The source of the problem was the 'log' keyword at the end of my ACL's.

access-list 100 permit ip host **log**
access-list 101 permit ip host **log**

According to Cisco, you should never use 'log' with NAT ACLs. The observed behavior was that the traffic would be properly NAT'd in one direction, but in the other the NAT would not be applied.

The corrected ACL's are:

access-list 100 permit ip host
access-list 101 permit ip host
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.