topic You should be able to do this in Network Security

NAT / Port Forward

GRANT3779 — Tue, 12 Mar 2019 05:33:50 GMT

Hi All,

I have the following config -

object network Server
nat (inside,outside) static x.x.x.x

access-list OUTBOUND_IN extended permit tcp any object Server eq 3389

object network Server
host 192.168.10.10

Now this allows me to access the "Server" from the Outside on port 3389.

Some clients however try to access the "Server" on a different port, e.g let's just say port 2222.

How do I enable the FW to listen for Inbound requests on port "2222" to my "Server" and then forward them onto port 3389?

Thanks

You should be able to do this

Jon Marshall — Fri, 27 Feb 2015 00:46:45 GMT

You should be able to do this but you need to modify your configuration.

So firstly you need to change your current static NAT to a static PAT ie. -

object-network Server
host 192.168.10.10
nat (inside,outside) static x.x.x.x service tcp 3389 3389

if you now try to use the same Server object I believe it will overwrite your first statement. You can try it but if it does then create a new object for your second statement -

object-network Server1
host 192.168.10.10
nat (inside,outside) static x.x.x.x service tcp 3389 2222

Jon

Hi Jon,I assume the ACL still

GRANT3779 — Fri, 27 Feb 2015 12:47:12 GMT

Hi Jon,

I assume the ACL still needs to be on the Outside Interface, allowing the relevant ports, e.g 2222 and 3389?

Could I keep the current static NAT I have then create a new Object for my second one and have a static PAT under that?

Yes, you still need the acl

Jon Marshall — Fri, 27 Feb 2015 12:50:30 GMT

Yes, you still need the acl and you need to allow the new port as well.

I'm not sure you can use a static NAT and PAT together although I could be wrong.

If the server is only used for 3389 currently then I would go with two static PAT statements as described.

Jon