Unable to do port range forwarding on Cisco 1811 Integrated Services Router

[Ansuna]

Right now I am having Cisco 1811 Integrated Services Router which is configured with Fas0 so that it can pull DHCP. It is used into cal clinic VAN hence the setup should be transparent for all the users. The idea of using DHCP is it could pull DHCP address and NAT behind of that particular address.
Following are the relevant command.

ip dhcp excluded-address 10.0.0.1 10.0.0.4
 
ip dhcp pool VANnet
network 10.0.0.0 255.255.255.240
default-router 10.0.0.1
dns-server 10.0.0.1
!
interface Fas0
ip address DHCP
ip NAT outside
!
interface VLAN 1
ip address 10.0.0.1 255.255.255.240
ip NAT inside
!
ip nat inside source list 1 interface Fas0 overload
!
access-list 1 permit 10.0.0.0 0.0.0.255

after that I have defined static NAT for the purpose of port forwarding

 
ip nat inside source static tcp 10.0.0.2 (Tandberg) 1719 interface FastEthernet0 1719
ip nat inside source static tcp 10.0.0.2 1720 interface FastEthernet0 1720

there were lots of issues with H.323 and NAT and I went ahead done the with following.

ip nat inside source static udp 10.0.0.2 2326 interface FastEthernet0 2326
ip nat inside source static udp 10.0.0.2 2327 interface FastEthernet0 2327
ip nat inside source static udp 10.0.0.2 2328 interface FastEthernet0 2328

can you tell me how can I do port forwarding setup on my router???

[Rhesa]

If they are using private address then you should not use 10.x.x.x. as they are using private address there will be problem with H.323. also you should make ‘ip nat inside source static 10.0.0.2 interface FastEthernet0´statement as ‘ip nat inside source list 1 interface Fas0 overload’.

[Suigetsu]

Well I am sure that PIX 525 will spoil everything. Until and unless you have open up the and NAT 67.x.x.x address to the outside address on your router. You should have reserved IP address for the DHCP server. Hence VAN will automatically get the same IP address and if you change the router into the VAN then you will need to move towards the MAC address of the FastEthernet0 to new router.

[Roxanne's]

In this particular situation I will recommend that you should go for ‘ip nat inside static 10.0.0.2 interface Fastethernet0’ if you are looking to have NAT only for any of the specified port numbers. You can do the same by using following manner.

ip nat inside source static 10.0.0.2 10.180.16.250 route-map BLAH extendable
!
ip access-list extended ACL-FOR-THE-TANDBERG
permit tcp host 10.0.0.2 any eq www
permit tcp host 10.0.0.2 any eq 443
permit udp host 10.0.0.2 any eq 1719
permit tcp host 10.0.0.2 any eq 1720
permit udp host 10.0.0.2 any range 2326 2373
permit tcp host 10.0.0.2 any range 5555 5587
!
route-map BLAH permit 10
match ip address ACL-FOR-THE-TANDBERG

the above mentioned solution will work on WAN address 10.180.16.250. however you cannot change the interface.