Port range forwarding using ASA 5505

[edwardd0017]

Hello,

I'm trying to forward a huge number of ports (8500-8600). I tried using the ASDM but I'm getting an error please see attached file. How do I achieve forwarding the above ports?

Thanks in advance!

-Ed

[Seb Rupik · Accepted solution]

Hi there,

I don't think you can put a range of ports in a nat statement like that. Instead define an object group of tcp ports. (I have ommited some of the service definitions so you'll need to fill them in):

!
object-group servier SVR_services
 service tcp source eq 8500
 service tcp source eq 8501
...
 service tcp source eq 8599
 service tcp source eq 8600
!
object network Outside_to_Inside_OnSSI_MediaSVR_Stream
 nat(inside,outside) static interface service SVR_services SVR_services
!

Don't forget to ammend your ACL_in for the outside interface for each of these ports.

cheers,

Seb.

[Marius Gunnerud · Accepted solution]

Actually you can not use object group for NAT. you need to create a regular service object for this.

for example.

object service PORTS

  service tcp source range 8500 8600

object network SERVER

  host 10.10.10.10

nat (inside,outside) source static SERVER interface service PORTS PORTS

If you require several different port ranges or ports, each of these would need a seperate NAT statement.

--

Please remember to select a correct answer and rate helpful posts