ASA8.4 Port Mapping Section
Method 1:
a. Do nat under object
Object network test
Host 100.1.1.3
Object network R3
Host 192.168.2.1
Object network R3
Nat (inside,outside) static test service tcp telnet 50000
# # #
The external network test port 50000 is mapped to the intranet R3 port 23 (telnet).
# # #
Ciscoasa (config) # show xlate
1 in use, 3 most used
Flags: d-DNS, I-dynamic, r-portmap, s-static, I-identity, T-twice
TCP PAT from inside:192.168.2.1 23-23 to outside:100.1.1.3 50000-50000
Flags sr idle 0:00:06 timeout 0:00:00
# # #
b.
Object network server
Subnet 192.168.2.1 255.255.255.255
Object service telnet
Service tcp source eq telnet
Object network test
Host 100.1.1.3
Object service 50000
Service tcp source eq 50000
Nat (inside,outside) source static server test service telnet 50000
# # #
Telnet here is the name of object.
# # #
Ciscoasa (config) # show xlate
1 in use, 3 most used
Flags: d-DNS, I-dynamic, r-portmap, s-static, I-identity, T-twice
TCP PAT from inside:192.168.2.1 23-23 to outside:100.1.1.3 50000-50000
Flags sr idle 0:03:11 timeout 0:00:00
Ciscoasa (config) #
# # #
Port 23 has been successfully mapped to 50000.
# # #
Method 2: range mapping. Multiple discontiguous port mappings, using the following method.
Object network test
Host 100.1.1.3
Object network R3
Host 192.168.2.1
Object service telnet
Service tcp source eq telnet
Object service smtp
Service tcp source eq smtp
Object service 3000-5000
Service tcp source range 3000 5000
Nat (inside,outside) source static R3 test service telnet telnet
Nat (inside,outside) source static R3 test service smtp smtp
Nat (inside,outside) source static R3 test service 3000-5000 3000-5000
Ciscoasa (config) # show xlate
3 in use, 9 most used
Flags: d-DNS, I-dynamic, r-portmap, s-static, I-identity, T-twice
TCP PAT from inside:192.168.2.1 23-23 to outside:100.1.1.3 23-23
Flags sr idle 0:16:33 timeout 0:00:00
TCP PAT from inside:192.168.2.1 25-25 to outside:100.1.1.3 25-25
Flags sr idle 0:16:02 timeout 0:00:00
TCP PAT from inside:192.168.2.1 3000-5000 to outside:100.1.1.3 3000-5000
Flags sr idle 0:01:58 timeout 0:00:00
Ciscoasa (config) #
