Port Forwarding Multiple Ports to Single IP Address

Posted on 2014-08-25
Last Modified: 2014-08-30
I have been given the task of moving a Cisco PIX 525 to a Cisco ASA 5515-X. The PIX is running 6.3(5), the ASA 9.1(1). I'm plodding along, but now I am stuck. I would like to port forward multiple ports to a single internal IP address.  The code on the PIX looks like this:

access-list outside_access_in permit tcp any host eq https
access-list outside_access_in permit tcp any host eq 5704
static (inside,outside) netmask 0 0

How does one go about doing this on the ASA 9.1?

This is my first time working with these new ASA devices.
Question by:OmniSystems
    LVL 20

    Accepted Solution

    Create a network object with nat, access list almost like normal... the big difference is that ACL's are all "real IP" access lists so the outside_access_in acl will reference private IP's, not public. I like to go all object based whenever possible.

    access-list outside_access_in permit tcp any host eq https
    access-list outside_access_in permit tcp any host eq 5704
    static (inside,outside) netmask 0 0

    will become

    object net EXTHOST-

    object net HOST-
    nat (inside,outside) static EXTHOST-

    object service SERVICE-HTTPS
    service tcp destination eq https
    description HTTPS port 443

    object service SERVICE-TCP-5704
    service tcp destination eq 5704

    service-object object SERVICE-HTTPS
    service-object object SERVICE-TCP-5704

    access-list outside_access_in permit object-group EXTSERVICES-HOST- any object HOST-

    I realize that my example makes it seem like 9.1 requires a TON of extra work... yes and no. There are ways to make 9.1 pretty much as short as 8.2.5 and below, but in the long run going object based for everything will end up make life pretty awesome when it comes to making changes. For example, if you needed to open port 80 to the server, you only need to add the service-object to EXTSERVICES-HOST- and it will take effect on all references with no need to touch all the ACL's.

    Author Comment

    Thanks for this information. I will be working with it today. Question.

    Would the command - "access-group outside_access_in in interface outside" still be needed?

    Author Comment

    BTW, the object oriented approach makes a lot of sense in the long run.
    LVL 20

    Expert Comment

    Yes, attaching the ACL to the interface is required for the inbound functions that you want. You can name the ACL whatever you want of course, but it must be applied to the interface in the direction you need it applied.

    Author Closing Comment

    Great help and example given was clearly explained.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Join & Write a Comment

    In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
    We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now