topic Syntax looks ok to me. You in Network Security

Port Forwarding Outside Interface

chevymannie — Tue, 12 Mar 2019 08:43:04 GMT

Wanted to make sure I had my syntax right for this. I'm trying to forward a port say 8030 from my outside interface to a host on the inside on 3389.

Here's what I have so far

object network 1.1.1.1

host 1.1.1.1

nat (inside,outside) static interface service tcp 3389 8030

access-list outside_in extended permit tcp any host 1.1.1.1 eq 8030

Trying to get this to work and I'm not seeing any hits on my outside ACL.

Karsten Iwen — Fri, 30 Dec 2016 17:17:56 GMT

1.1.1.1 is your internal IP in this scenario?
In the ACL you have to use the real port, same as you use the real IP (1.1.1.1):

access-list outside_in extended permit tcp any host 1.1.1.1 eq 3389

Rahul Govindan — Fri, 30 Dec 2016 17:33:40 GMT

NAT Syntax looks ok to me, just need to check the ACL port to . You can use this guide as reference:

https://supportforums.cisco.com/document/132066/asa-nat-83-nat-operation-and-configuration-format-cli#NETWORK-OBJECT-NAT

Can you run a packet-tracer from outside to inside to see what happens to the packet?

packet-tracer input outside tcp 4.2.2.2 12345 <public interface ip> 8030 detailed

chevymannie — Wed, 11 Jan 2017 01:16:38 GMT

Worked like a charm once I put the real port in the outside ACL. Thanks Karsten.