ASA Port Redirect Issue

[Tauer Drumond]

Hi all,

I'm trying to redirect a traffic as follow:

HOST A connects at ASA's outside interface at port 8888.

ASA must redirect traffic to host B at port 3389.

Resuming.........HOST A must access port 3389 of HOST B

Is that possible?

See attachment to see the topology and IP addresses. It's simple, but I'm not achieving the goal

Thanks!

Tauer

[Jon Marshall · Accepted solution]

Yes it should be possible. Something like -

static (inside,outside) tcp 100.100.100.100 8888 192.168.1.100 3389 netmask 255.255.255.255

Jon

[Tauer Drumond]

Hi Jon,

But what happens if a diferent source must connect at same port 8888 and be redirected to a diferent destination port?
I think I must specify the source, have I?

[Edward Dutra · Accepted solution]

Hi...

Jon is correct:

static (inside,outside) tcp OutsidePublic IP 8888 RealPrivateIP 3389 netmask 255.255.255.255

or

static (,) tcp 8888 3389 netmask 255.255.255.255

The static basically says, anything arriving to the OutsidePublicIP on port 8888, redirect it to RealPrivateIP port 3389. Nothing in the static statement cares about the source. Only the destination.

[Tauer Drumond]

So.... will I never be able to specify the source?

Thanks!

[Jon Marshall]

As far i know you cannot do this because the port used on the public IP must be different.  You can use different port numbers with the public IP and then map these to the same host with different ports. But not the same port on the public IP.

Jon

[Tauer Drumond]

ok. I got it.

I made a test and worked fine, even not expliciting the source I'll be able to do what I want

Thank you all