こんばんわ。
手元の環境なので ちょっとIPアドレスが違いますが、例えば以下要件の場合は・・・。
--------------------------------------------------------
送信元(outside): 1.0.0.1
宛先(inside) : 192.168.100.1:5001 →(NAT)→ 192.168.100.1:5002
--------------------------------------------------------
設定は以下感じになるかなぁ、と思います。
--------------------------------------------------------
object network OUT-1.0.0.1
host 1.0.0.1
!
object network IN-192.168.100.1
host 192.168.100.1
!
object service TCP-5001
service tcp destination eq 5001
!
object service TCP-5002
service tcp destination eq 5002
!
nat (outside,inside) source static OUT-1.0.0.1 OUT-1.0.0.1 destination static IN-192.168.100.1 IN-192.168.100.1 service TCP-5001 TCP-5002
--------------------------------------------------------
show nat detailで、どんな変換がされるか直観的に確認できます。
--------------------------------------------------------
ciscoasa/pri/act(config)# show nat detail
Manual NAT Policies (Section 1)
1 (outside) to (inside) source static OUT-1.0.0.1 OUT-1.0.0.1 destination static IN-192.168.100.1 IN-192.168.100.1 service TCP-5001 TCP-5002
translate_hits = 1, untranslate_hits = 1
Source - Origin: 1.0.0.1/32, Translated: 1.0.0.1/32
Destination - Origin: 192.168.100.1/32, Translated: 192.168.100.1/32
Service - Origin: tcp destination eq 5001 , Translated: tcp destination eq 5002
--------------------------------------------------------
動作確認はパケットトレーサでできます。
--------------------------------------------------------
ciscoasa/pri/act(config)# packet-tracer in outside tcp 1.0.0.1 1234 192.168.100.1 5001
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (outside,inside) source static OUT-1.0.0.1 OUT-1.0.0.1 destination static IN-192.168.100.1 IN-192.168.100.1 service TCP-5001 TCP-5002
Additional Information:
NAT divert to egress interface inside
Untranslate 192.168.100.1/5001 to 192.168.100.1/5002
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group OUT in interface outside
access-list OUT extended permit ip any any
Additional Information:
Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (outside,inside) source static OUT-1.0.0.1 OUT-1.0.0.1 destination static IN-192.168.100.1 IN-192.168.100.1 service TCP-5001 TCP-5002
Additional Information:
Static translate 1.0.0.1/1234 to 1.0.0.1/1234
Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (outside,inside) source static OUT-1.0.0.1 OUT-1.0.0.1 destination static IN-192.168.100.1 IN-192.168.100.1 service TCP-5001 TCP-5002
Additional Information:
Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 3636, packet dispatched to next module
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow ←通信が許可された。使えそうなNAT設定！
--------------------------------------------------------
show nat detailやパケットトレーサについて詳しくは 以下URLが参考になると思います。
https://supportforums.cisco.com/ja/document/12482501#show_nat_detail
https://supportforums.cisco.com/ja/document/12745356#hdr-2
あとNAT設定は、ASDMから実施されるのもお勧めです。 ASDMは複雑なNAT設定をするときに便利です。
