Will assume for your example that external users corporate can only use port 80 outbound from their network. THey need to access port 7777 behind the asa on a private inside host.
object network extuser
host 24.223.23.16
object network PCwith_Server
host 192.168.2.12
object network Nat4portforwardingService
host 192.168.2.12
object service specialfunction
service tcp destination eq 7777
object service corporate_port
service tcp destination eq 80
object-group catchall
service-object service special function
sercive-object service corporate_port
NOTE: I create the two service objects ports involved and lump them into a group object for the acl rule. It is still not clear in my mind how the asa actuallyhandles acls and nat in order due to a poorly documented support and unnat process evident in packet tracing. Normally according to docs ACLs are done first then nat, so one would expect in our example that port 80 only needs to have an outside ACL rule. Due to experience I put both in the acl rule.......
-----------------------------------------------------------------------------------
ideally only need acl for port 80
access-list outside_access_in extended permit object corporate_port object extuser object PCwith_Server
to be safe this is what I use......
access-list outside_access_in extended permit object-group catchall object extuser object PCwith_Server
(for any external user replace 'object extuser' with 'any'
-------------------------------------------------------------------------------------
object network NAT4portforwardingService
nat (inside,outside) static interface service tcp 7777 www
---------------------------------------------------------------------------------------
