PCs on the Intranet Were Unable to Access the Internal Server Because Intrazone NAT Was Not Configured

Publication Date:  2015-07-03 Views:  256 Downloads:  0
Issue Description
Networking: PC------USG-----server 

NAT server was configured on the USG for users on the intranet and Internet to access the internal server. 

If static port mapping was configured, only some web pages could be displayed for users on the Internet. 

nat server protocol tcp global 18888 inside 18888 vrrp 5 nat server protocol tcp global 18443 inside 18443 vrrp 5

When global port mapping was configured, the internal server could be normally accessed. 

nat server protocol tcp global any inside any vrrp 5 
Handling Process
1. The following bidirectional NAT was displayed after global port mapping was configured.

  tcp  VPN: public -> public 
  Zone: trust -> trust  TTL: 00:00:10  Left:  timeout  
  Interface: G0/0/0  Nexthop:  MAC: 00-00-5e-00-01-17
  <-- packets:12 bytes:2297   --> packets:18 bytes:3680[]-->[]

2. In addition to ports 18888 and 18443, the PC might also access other ports. However, the packets on the PC indicated that the PC did not access other ports of the server.

3. If the PC did not access other ports, the fault might occur because the server accessed other addresses, and a packet analysis proved so. The server accessed its global address instead of the real destination. To resolve this issue, interzone NAT or global NAT server must be configured.

When the communication between the PC and server was successful, the server ( initiated access to In this case, the traffic in both directions matched the same NAT server. This scenario is also known as bidirectional NAT. In the case of unsuccessful communication, the source port of the initiator was not 18888. Therefore, the traffic matched NAT in one direction. In this case, the source address of the traffic sent to the server was still However, the request of the PC destined to
Root Cause
The PC accessed the public address mapped to the server through NAT server. However, NAT server was not implemented for the ports. Therefore, intrazone NAT must be configured to resolve the problem. 
Configure intrazone NAT to resolve the problem.