Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network.

As I understand this you can only nat a single port per object. This caused a bit of a litter around in a config as I have to specify individual objects for the same host (IP) to redirect individual ports.

It looks as follows:

object network ratatouille-4569
 nat (inside,outside) static interface service udp 4569 4569 
object network ratatouille-ssh
 nat (inside,outside) static interface service tcp ssh ssh 

Now this approach have few obvious problems (especially if you've more complex/more rules) eg. if you need to change that internal host's IP address, you've to do this for each object individually.

In this specific case, I have 7 ports to redirect to this specific host.

I'd appreciate any advice about best-practice as how to do this.

share|improve this question

It's imposible. You need to either specify each of the mapped ports manually or just set up a regular static NAT for all the TCP / UDP ports:

object network ratatouille
 nat (inside,outside) static interface
share|improve this answer
Yeah but in this case you're using the whole IP for just one internal host. In my case, I've a single IP but multiple internal host which I want to redirect ports to. I was more hoping for some advice what's the best way to maintain that. Any specific naming conventions you guys use or some other tricks? Or just do as I did above and keep it going like this? – bart613 Feb 28 '13 at 15:24

... and control desired ports with ACL assigned to outside interface

access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 22 access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 4569 access-list ratatouille-port-control permit tcp any host ratatouille.inside.IP eq 8080 access-group ratatouille-port-control outside in

share|improve this answer
Please give a complete answer. This appears to be a comment or follow-on to another question, but your answer can appear on its own so the meaning is unclear. – Andrew Schulman Jun 28 '15 at 10:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.