08-26-2015 05:27 AM - edited 03-11-2019 11:29 PM
Dear Sir/Madam,
I want to limit dynamic PAT port range like below
global (outside) 4 10.16.1.16 netmask 255.255.255.255
nat (inside) 4 access-list test
I want to use 10.16.1.16 port from 10000 to 60000. or i just don't want to use port 30001.
But i haven't find method?
thank you!
Tom
08-26-2015 12:25 PM
You could do something like the following:
object network NAT-IP
host 10.16.1.16
object network LAN
subnet 11.11.11.0 255.255.255.0
object network REMOTE-NET
subnet 12.12.12.0 255.255.255.0
object service PORT-RANGE
service tcp destination range 10000 60000
nat (inside,outside) source dynamic LAN NAT-IP destination static REMOTE-NET REMOTE-NET service PORT-RANGE PORT-RANGE
--
Please remember to select a correct answer and rate helpful posts
08-26-2015 06:02 PM
Hi marius
Thank you I will try it
can I add multiple entries under object service PORT-RANGE
Tom
08-27-2015 12:30 AM
No, you can not have multiple entries under object service PORT-RANGE. To have multiple services under one object you need to create an object-group, but NAT does not support object groups so you will need to create individual NAT statements for any other ports.
--
Please remember to select a correct answer and rate helpful posts
08-27-2015 01:32 AM
oh, that is complicated, we want to kick out just only one port 16000 from 1-65535 port range.
that means we can't user port number 16000 within port range 1-65535?
if we can only config one permit port range from 1-15999, how can I config another permit range 16001-65535?
thank you!
Tom
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide