Tons of NAT translations??

One of my production routers has an interface connected straight to our internet provider. This is (should be) only used for inbound VPN connections.

All internet traffic is routed out a local interface through our firewall.

NAT is currently enabled, but nothing should really ever be NAT'd, since no traffic goes straight out the internet interface... I thought.

I checked my nat translations today, and there are hundreds, if not thousands, from a single internal address to a single external address.

Oddly enough, the external address has a private IP (192.168.X.X)... The internal address isn't on any subnet I have seen on my network, ever. I'm baffled.

I started doing NetFlow so I could monitor the traffic on the interface, and I can't seem to find EITHER of these IP's. What am I missing here???

Any suggestions would be greatly appreciated.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

notgoing2fail

Wow, sounds interesting, keep us posted. Of course, someone more experienced is going to ask you to provide your config....

chmorin

If this isn't a production network, disable NAT and see what happens.

Agent6376

mzinz wrote: »

One of my production routers

I couldn't resist.

tim100

Post your NAT configuration and interface configuration as well as a "sh ip nat translations".

rwwest7

Could that be the people who are VPN'd in browsing the web?

ColbyG

post the output