Static NAT: Port Forward Has No Inside Interface
A published inside server is unreachable even though the translation is in the configuration. Diagnose it and fix it yourself, live, right below.
Symptom
The translation exists, but inbound TCP 8080 never reaches the server. Trace the NAT roles and repair the server-facing path.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
R1 has a static TCP translation from its public address on port 8080 to an inside web server on port 80. External connections time out, even though the translation appears in the configuration.
What you'll practice
- Read static entries in the NAT translation table
- Inspect NAT configuration without assuming the translation is the fault
- Identify inside and outside interfaces from NAT statistics
- Correct a missing NAT interface role
- Verify the repaired boundary from operational state
The topology
One edge router separates a web server on GigabitEthernet0/0 from an ISP on GigabitEthernet0/1. A static TCP port forward publishes the inside server through the router's public address.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ip nat translationsshow running-config | section ip natshow ip nat statisticsTopology diagram
Frequently asked
Why does seeing the static entry not prove NAT will work?
It proves IOS accepted the mapping, not that packets cross an inside-to-outside boundary. Interface roles and routing still determine whether traffic is eligible for translation.
Should the public interface also be checked?
Yes. NAT requires the boundary to be labelled on both sides. In this scenario the outside role is present and the missing server-side inside role is the asymmetric clue.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.