Cisco ASA 8.4(1) ADSM 6.4

I'm struggling with forwarding SSH connections from the outside into a server inside my network on a non standard port.

What would the command line look like if I wanted to forward port 2828 from the outside to port 22 on a specific IP on the inside ?

Update: Provide config, started out with setting the standard SSH port on the outside since I cant get the above to work.

    : Saved
ASA Version 8.4(1) 
hostname troll
enable password XXXXXXX encrypted
passwd XXXXXXX encrypted
interface Vlan1
 nameif inside
 security-level 100
 ip address 
interface Vlan2
 mac-address 0022.6b6e.4165
 nameif outside
 security-level 0
 ip address dhcp 
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
dns domain-lookup inside
dns server-group DefaultDNS
same-security-traffic permit inter-interface
object network obj_any 
object network outside 
 description outside 
object network vm 
object network inside-host-object 
access-list outside_access_in extended permit tcp any object inside-host-object eq ssh 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
object network inside-host-object
 nat (inside,outside) static interface service tcp ssh 2828 
access-group outside_access_in in interface outside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0

dhcp-client client-id interface outside
dhcpd auto_config outside
dhcpd address inside
dhcpd dns interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
service-policy global_policy global
prompt hostname context 
: end
no asdm history enable

You'll be configuring this in a network object defined for your inside host. If you already have one, you'll need to make the appropriate changes to it.

object network inside-host-object
 ! is your internal address for this server..
 ! ..and is the external address that you want to use.
 nat (inside,outside) static service tcp 22 2828

And you'll also need to make sure that the traffic is allowed in the outside interface's ACL - allow the traffic based on the post-NAT IP and port (so, in this example, a destination of, port 22), which is a change from older ASA behavior.

  • I might have forgot to mention that I have a single outside IP number assigned to the ASA by DHCP. object network obj_any nat (inside,outside) dynamic interface ! nat (inside,outside) after-auto source dynamic any interface – ROAR Jan 21 '12 at 22:01
  • 1
    Then use interface instead of – Shane Madden Jan 21 '12 at 22:02
  • The config is included above, any obvious misstakes there ? – ROAR Jan 21 '12 at 22:16
  • @ROAR Your interface ACL is set to allow the SSH traffic to, but that's not the object group that you applied the NAT to - you applied it to inside-host-object, copy-paste issue? Also, you've got that nat command mapping from port 22 on the inside to port 22 on the outside - this wouldn't achieve the goal of using port 2828. – Shane Madden Jan 21 '12 at 22:20
  • Updated it again... – ROAR Jan 21 '12 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.