Forwarding a RANGE of UDP ports , never solved issue ??

[federico_tv]

Hi

I've look a lot for a solution to forward a range of UDP ports from internet to a single host on the LAN for VoIP traffic

The SINGLE port working method is :

ip nat inside source static UDP <LAN ADDRESS> <PORT> interface <INTERNET_INTERFACE> <PORT>

The RANGE of ports seems to be a unresolve issue

A solution like:

access-list 110 permit UDP host <LAN ADDRESS> any range <PORT-RANGE>

route-map UDP_PORTS

match ip address 110

ip nat inside static route-map UDP_PORTS <INTERNET_INTERFACE>

fails to work  (no nat translation shown, no UDP ports forwarded)

many others solutions seems not working too

Since I can't add thousand of single static entry , is there anyone knowing a working solution for the issue ???

Thank you very much

[Jan Rolny]

Hi Federico,

what version of ASA you use?

I have 8.4(2) and i can make nat

nat (inside,outside) source dynamic network_object interface service any smtp

so thi do that all network specified in object is nated if it attempts to connect to outside SMTP server for me.

It would be simillar in revers situation for you.

Regards,

Jan

[federico_tv]

Sorry, I'm using a 877 router as well other 18xx ones...

[blau grana]

Hello Federico,

I think there is no solution for this, probably just some workarounds which each technician made up during dealing with this problem.

If you have posibility to configure static 1:1 NAT and with ACL allow only desired ports, I think it is best way to solve this issue.

Best Regards

Please rate all helpful posts and close solved questions

[federico_tv]

HI

Thank you for your sad answer......

I mean that it is embarassing that such a device like a recent cisco device is unable (or at least their buiders don't provide the capability) to redirect a range of UDP ports coming to the internet interface to an inside LAN machine, while a single NAT rule does it !!!

I think a simple cisco router actually can do things 100 times more complicated, that's all...

Also, from what I heard and read, it can be done with TCP ports....

If anyone has further informations about, he's well accepted !

Thank you