troubleshooting Question

How to Port Forward Multiple Ports to Different Destinations - ASA 9.x

Avatar of Adam R
Adam R asked on
Network Security
1 Comment1 Solution295 ViewsLast Modified:
Hi all,

I have a setup where I have 2 different internal devices that need to share the same external IP, but I want inbound traffic from external sources to go to one of the two different devices based on what destination ports are being used.  

Device 1:
Internal IP 10.10.10.1
Listening on ports: TCP/UDP 80, TCP/UDP 8000, TCP/UDP 8001

Device 2:
Internal IP 10.10.10.2
Listening on ports:  UDP 18000, UDP 19000

External Shared IP 1.1.1.1

So basically, if an outside source navigated to 1.1.1.1 at any of the TCP/UDP ports of 80, 8000, or 8001 they'd land on Device 1, but if they navigated to 2.2.2.2 at any UDP ports 18000 or 19000 they'd land on device 2.

I'm running ASA 9.3 code, and I see where I can do object nat and add the "service tcp" options, but I can only specify the one line there.

When I set it up with object groups as below:

object-group service DEVICE1_SERVICES
 service-object object TCP_80
 service-object object UDP_80
 service-object object TCP_8000
 service-object object UDP_8000
 service-object object TCP_8001
 service-object object UDP_8001

object-group service DEVICE2_SERVICES
 service-object object UDP_18000
 service-object object UDP_19000

And then Go to do a static nat configuration:

nat (inside,outside) source static DEVICE1_REAL DEVICE1_TRANSLATED service DEVICE1_SERVICES....

...it gives me an error stating that have to use a single service object at the end there, not a service GROUP.

So, I guess my question is - is there any way to accomplish this on ASA to where I don't have to have a separate NAT statement for each and every service I need translated?  I have 48 total devices I need to do this with, and trying to keep the config under control.
ASKER CERTIFIED SOLUTION
Harold Bowlin
Owner/Network Architect

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Log in to continue reading
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform for $9.99/mo
View membership options
Unlock 1 Answer and 1 Comment.
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
The Value of Experts Exchange in My Daily IT Life

Experts Exchange (EE) has become my company's go-to resource to get answers. I've used EE to make decisions, solve problems and even save customers. OutagesIO has been a challenging project and... Keep reading >>

Mike

Owner of Outages.IO
Phoenix, Arizona, United States
Member Since 2016
Join a full scale community that combines the best parts of other tools into one platform.
Unlock 1 Answer and 1 Comment.
View membership options
“All of life is about relationships, and EE has made a virtual community a real community. It lifts everyone's boat.”
William Peck

Member since 2004