Strange static NAT Issue
I am having a strange problem with static NAT. We have BM3.8 SP2 installed on NW Small Business 6.5. The public interface is configured to do both static and dynamic NAT. I have added two secondary IP addresses that are bound to the public interface, and setup the NAT table, using inetcfg, for two different cooresponding private IPs. I setup filters and am able to successfully use these NAT translations through BM as intended. – In other words, they work fine. Now the problem. I need to add another static NAT entry. I add the secondary IP and it pings fine from the outside (thanks to a temporary filter for ICMP to/from anywhere). Then I add a new entry in the static NAT table to translate this address to a third unique private side IP. At this point the new secondary IP will no longer ping as before and it is not translating to the private side as the others do. I have exhausted my brain in trying different configurations to get this to work. For example, I have tried with filters down, I have tried adding this “third” one before the other two, I have tried re-doing all of it, I have tried different secondary IP addresses (public interface is behind a PIX firewall) and even different private side IPs. All still the same non-working result. On the public side I can still ping the other two and their NAT translations work fine. I know for sure that everything is in the correct subnet. If I dump the arp table on a machine sitting on the public side of BM after pinging each of the three secondary IPs they ALL show that they resolve to the ethernet address of the public interface on the BM server. It’s like the packets are getting to BM and it is responding, but for some reason it is deciding not to translate it. Finally, as added information, I can ping the ‘third’ IP using nwping on the server and I can ping it from a private side machine. Is it somehow bound to the wrong side interface? How could this be if BM public is reporting for ARP requests? I have not yet attempted a tcpip debug since the machine is a production machine.
Any ideas? Oh by the way, the translations are for three different VNC servers on the private side of the BM network. Two work fine, but the third will not work! (and yes I tried putting the ‘third’ secondary IP address translation to one of the two known working private side VNC server machines. No difference). I thought it might be a corrupt TCPIP.CFG file, but I tried on another identical server and it yields the exact same result.