Skip to main content

 

Cisco Meraki Documentation

Troubleshooting Port Forwarding and NAT Rules

  1. Last updated
  2. Save as PDF

Overview

This article provides troubleshooting information for common issues that can occur when configuring port forwarding, 1:1 Network Address Translation (NAT), or 1:Many NAT forwarding rules on a Cisco Meraki MX WAN appliance.

Before troubleshooting a forwarding rule, review its expected behavior.

When the MX receives traffic on the primary uplink with a destination IP address that matches the uplink, the MX evaluates the configured port forwarding rules. The MX determines whether the traffic matches a forwarding rule by comparing the configured protocol, public port, and allowed remote IPs.

When the traffic matches a forwarding rule, the MX translates the destination IP address to the configured LAN IP address and the destination port to the configured local port. The MX performs the reverse translation for traffic leaving the LAN toward the internet.

Port forwarding rules section under the Security and SD-WAN Configure Firewall page
 

The following diagram illustrates a port forwarding rule and the resulting forwarding behavior after the rule is applied.

Topology showing an expected traffic flow with the rule from the previous picture configured

For 1:1 NAT and 1:Many NAT rules, the expected behavior on the internet side of the MX differs slightly. The NAT rule specifies the public IP address that must match the destination IP address, and the destination MAC address may differ. Otherwise, the forwarding process remains the same.

General troubleshooting guidance

Use packet capture on the MX to gather information when troubleshooting forwarding rules. Capture packets simultaneously on the LAN and internet interfaces. Comparing both captures shows how the MX handles forwarded traffic and helps determine whether the issue occurs upstream or downstream of the MX.

Troubleshoot a misconfigured server

  1. You may configure the forwarding rule correctly, but the destination server may not respond.
  2. Verify that the server is online and listening for traffic on the correct port.

The following diagram illustrates an HTTP connection attempting to establish a connection to a server that is either offline or not listening on port 80.

Topology showing a misconfigured port forwarding rule where a HTTP connection is attempted to a server that is not online or listening on port 80

Troubleshoot an upstream device with a stale ARP cache

If you recently installed the MX, or moved the MX WAN IP address from another device, the upstream device may still use the MAC address of the previous device. 

Troubleshooting steps

  1. Ensure that the upstream device sends traffic to the correct MAC address of the MX.
  2. Reboot the upstream modem or device, or force the upstream device to clear its ARP cache.

For more information, see 1:1 NAT Rules Not Working Properly After Installing MX.

The following diagram illustrates traffic being sent to the wrong MAC address, which prevents the MX from translating the traffic to the LAN side.

Topology showing how a stale arp cache results in traffic being sent to the wrong MAC address
 

  1. Capture packets on the internet and LAN interfaces of the MX.
  2. Verify that traffic reaches the internet interface with the correct IP address and port, but is absent on the LAN interface.
  3. Compare the destination MAC address in the Ethernet header with the MAC address listed on Monitor > Appliance Status in the Meraki dashboard

Troubleshoot an upstream firewall blocking traffic

  1. Check whether the expected traffic reaches the internet interface of the MX.
  2. Review the configuration on any firewall between the client device and the MX to confirm the firewall does not block the traffic.

Topology showing traffic being blocked due to an MX firewall rule

Troubleshoot a remote IP not allowed

  1. If the Allowed Remote IPs column for the forwarding rule is not set to Any, the source IP address of the traffic must be allowed. If the source IP address is not allowed, the MX does not forward the traffic.
  2. Configure the Allowed Remote IPs column using individual IP addresses or IP address ranges in Classless Inter-Domain Routing (CIDR) notation. Separate multiple IP addresses or CIDR ranges with commas.

For example: 192.168.1.5,172.16.0.0/12

The following diagram illustrates traffic that the MX does not forward because the source IP address does not match any of the configured allowed IP ranges.

Topology showing traffic being blocked due to a disallowed remote IP range on the MX

Troubleshoot a mismatched public port

  1. If traffic reaches the internet interface of the MX but the MX does not forward the traffic, verify that the destination port and protocol match the configured port forwarding rule.

For example, if you attempt to access a web server using HTTPS (TCP:443) and the forwarding rule is configured only for HTTP (TCP:80), the MX does not forward the HTTPS traffic because the traffic does not match the configured rule.

The following diagram illustrates traffic reaching the MX with a destination port of 80, while the forwarding rule is configured for port 8080. Because the destination port does not match the configured forwarding rule, the MX does not forward the traffic.

Topology showing traffic being blocked due to a mismatched destination port

Additional resources

For additional information about forwarding rules on the MX, please refer to the following articles: