Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using a cisco ASA device with an external IP of (interface OUTSIDE) and an internal subnet of (interface INSIDE), how can I configure the ASA so that all traffic to a specific port on the external interface gets directed to an internal server (and the response is returned)

For example, if an external user connects to I want it redirected to;

share|improve this question
up vote 6 down vote accepted

TO get this working you will need to setup a static nat, and add to the access-list to allow the traffic once. (NAT happens before access-list: Details of Order of operations)

Static NAT

Static NAT's on cisco have always been weird (for me at least). Basic thing to remember is (HIGH,LOW) LOW, HIGH for this command.

static (inside,outside) tcp 5000 8080 netmask 0 0


This acl will need to be applied to what ever you have named your access-list attached to OUTSIDE interface. (Change: *outside_acl* )

access-list outside_acl extended permit tcp any host eq 8080


Sorry I don't have my test ASA in front of me, but this should be very close.

share|improve this answer
spot-on; I just set the Static NAT, confirmed that packets were then being rejected by the ACLs, and tweaked the ACL. – DrStalker Aug 14 '09 at 5:31
Glad I could help - Have a good day/night – Jeremy Rossi Aug 14 '09 at 7:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.