Traffic not following static NAT Routes

[Phizzle]

We have 1 dynamic for all internal traffic and 3 static routes for ports 25, 80, and 443. We are also translating the IP to a different address. However, it seems that none of these routes are being followed. The problem is that SMTP traffic is being 'tagged' w/ the serial0/0/0 address and not the translated address, which is causing problems w/ our PTR records.
Here's the current NAT setup...

ip nat inside source list 151 interface Serial0/0/0 overload
ip nat inside source static tcp xxx.xxx.x.7 25 xxx.xxx.xxx.58 25 extendable
ip nat inside source static tcp xxx.xxx.x.7 80 xxx.xxx.xxx.58 80 extendable
ip nat inside source static tcp xxx.xxx.x.7 443 xxx.xxx.xxx.58 443 extendable

It seems that everything is going out through overload and not being translated to the correct IP (which is the problem).

Thanks,

 

[Phizzle]

More information...
Router is Cisco 2811 IOS 12.3

 

[Kapfel]

what does access-list 151 look like?

 

[Phizzle]

ACL 151
access-list 151 deny ip 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 151 deny ip 192.168.1.0 0.0.0.255 192.168.101.0 0.0.0.255
access-list 151 permit ip 192.168.1.0 0.0.0.255 any
access-list 151 permit ip 172.16.1.0 0.0.0.255 any

 

[Kapfel]

X.X.X.7 is your inside address and X.X.X.58 is your global address correct?

If you remove the port assignments and lets say remove the deny statements from the acces-list does it translate at all or still doesnt work? try keeping the nat config simple to start with then add the complexity once its tranlating.

your trying to permit 192.168.1.0 in line 3 but you've already denied earlier in the list?

 

[Phizzle]

I think you may be correct - I think we may have to NAT everything to the .58 address and use the ACL to allow/deny..I'm not sure if that is as secure, but may be the only way to get mail to AOL...

 

[plshlpme]

it is working as it should with your current config.
if the packet originates from the outside world it will be natted to the correct internal ip.
if you originate the packet internally it will be overloaded and get your dynamic ip.

ive never tried but you may have to create another overload statement and overload all traffic with source (smtp server) out using the wan ip that you wish.