Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm dealing with my first Cisco ASA (a 5505), using the ASDM interface. I've got to forward HTTP, HTTPS, PPTP and another port to a couple of internal servers.

I'm pretty sure I've got it all figured out, and have successfully (I believe, haven't actually tested yet ;) ) created and applied Static NAT rules for everything above, except HTTPS.

Via the interface I can add the rule for 443, and all looks good, but when I hit [apply] I get the following error, and then the 443/HTTPS entry is removed:

[ERROR] static (inside,outside) tcp interface 443 443 netmask tcp 0 0 udp 0 unable to reserve port 443 for static PAT

ERROR: unable to download policy

I've had no problems creating my other rules, and can still successfully create other port rules (i.e.: '4434' as a test) so now I'm at a loss, any ideas?

Thanks in advance.

share|improve this question
up vote 3 down vote accepted

The Cisco ASDM runs on port 443, so you'll probably have to switch that to a different port before trying to forward 443 to an inside destination.

share|improve this answer
Worked like a charm! Thanks! – techie007 Feb 19 '10 at 16:16
Erik beat me because I had to walk over to my device to verify the physical location of the SN;). – Patrick R Feb 19 '10 at 16:32
+1 to Erik from slow poke. – Patrick R Feb 19 '10 at 16:34
Hehehe yeah, ya snail! Thanks again. ;) – techie007 Feb 19 '10 at 16:52

It sounds as though you may be creating a conflict with the 443 port reservation for your ASDM/HTTPS admin connection. If you've recently purchased the ASA5505 you may still fall within the included technical support that cisco provides. If so, they are really good at gettting people (at least me) past issues like this.

TAC support is at 1-800-553-2447

They'll ask for the SN number on the bottom of your device.

Edit: You could also turn off ASDM/HTTPS access and config over ssh or serial. That's were you'll probably head anyway once you get into administrating firewalls like this.

share|improve this answer
<pedantic>ASAs are NATing firewalls, not routers :)</pedantic> – Zypher Feb 19 '10 at 16:02
Thanks for providing the same answer only a minute or so later, I +1'd you for giving me the phone number. :) – techie007 Feb 19 '10 at 16:17
@Zypher - thanks - I have three of them myself and know that - apparently I need some sleep. – Patrick R Feb 19 '10 at 16:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.