Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not used to doing NAT on Cisco devices, and I'm tasked with bringing in traffic being sent to a public address that is routed to our gateway. I would like to NAT the traffic from our gateway (a Cisco 2901 router running IOS 15.0) to a private address.

From what I've read, I think this might work but I have a feeling I'm missing something.

interface GigabitEthernet0/1.1
ip address
ip nat outside

interface GigabitEthernet0/0.1
ip address
ip nat inside

ip nat inside source static udp 5060 5060 extendable is one of our private (MPLS) WAN addresses that routes to I'm trying to forward traffic sent to that address to an internal device at

Is that all there is to creating a one-to-one NAT, or am I missing something?

share|improve this question
up vote 2 down vote accepted

I think you didn't quite understand the concept of NAT.

NAT means hiding your private IP address(es) behind the public address(es) of your router's external interface; with NAT, you can:

  • Have a packet start from one of your internal addresses ( go outside your network and look to external devices like it originated from your router's external address (, and
  • Have a packet come from outside your network to some port on your router's external IP address ( and be forwarded by your router to one of your internal addresses (

But if a packet is going to some completely different address which is not managed by your router (like and is not passing through the router itself, there's nothing at all the router can do to "intercept" it and forward it to some other destination.

share|improve this answer is managed by the router in question. It's one of a small block (/29) of addresses being routed to it. – Cypher Nov 29 '11 at 20:09
What do you mean by "managed"? Is it assigned to one of the router's interfaces? You said the router's external interface has the address – Massimo Nov 29 '11 at 20:10
Our ISP is sending traffic destined for to our router. My understanding is that our router should be able to see these packets and change the destination, which the switches down the line would then be able to get to the device at – Cypher Nov 29 '11 at 20:12
If your router needs to receive and handle packets addressed to, it needs either to have that address assigned to one of its interfaces, or to have a route to where that address actually is. – Massimo Nov 29 '11 at 20:14
Hrm, I'm not sure that makes sense to me. Maybe I'm not explaining the setup well enough. The ISP is routing a /29 subnet to our router for us to handle ( Some of those packets will have a destination of This subnet will route through our router at You're saying that our router won't be able to translate the destination of these packets to an internal address unless we route them to another device? – Cypher Nov 29 '11 at 20:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.