I have a Cisco ASA-5505 firewall, which is currently configured to share our internet connection and do NAT for my LAN, as well as forward port 443 to an internal machine.

I need to forward port 2222 to a second internal machine, and I'm running into a bit of trouble. My understanding is that typically packets are forwarded to a machine with a rule like:

static (inside,outside) [Public IP] [Internal IP] netmask

However, when I try to add two of these rules, they conflict with each other.

I tried adding port-specific rules like this instead:

static (inside,outside) tcp interface 443 [internal IP 1] 443 netmask
static (inside,outside) tcp interface 2222 [internal IP 2] 2222 netmask

But then both ports were filtered (as per nmap from a remote machine).

My access-list rules currently look like this:

access-list outside-in line 1 extended permit tcp any host [public IP] eq 443
access-list outside-in line 2 extended permit tcp any host [public IP] eq 2222

Can anyone provide me a working set of static and access-list rules that will forward port 443 to one machine, and port 2222 to a different machine?

EDIT: I should mention that, unfortunately, the only access I have to this ASA is via telnet - I can't use ASDM.


FIrst, there can be some discrepancies based on what level of code you are running...

There's a difference betweeen your old static NAT rule and the new rules that would be required to split up the ports from a single WAN IP to multiple internal IPs.

You can get the details from Cisco on how to do this here: http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_objects.html

Youtube can also help visual learners..see here:


  • My understanding is that since this is a pre-8.0 ASA, nat objects aren't available to me, and static is the correct command to use. Am I mistaken? – CmdrMoozy Jun 10 '13 at 18:48
  • Looking at your static rules then, they should be right...you would use "interface" if you are using the outside interface's IP and static PAT. What isn't working when you say "both ports are filtered"? – TheCleaner Jun 10 '13 at 19:05
  • If I do nmap -sS -p 443 [Internal IP] from inside my network it reports 443/tcp open, whereas if I do nmap -sS -p 443 [Public IP] from outside my network it reports 443/tcp filtered. I would expect it to be open if the port was really being forwarded correctly. – CmdrMoozy Jun 10 '13 at 19:07
  • 1
    "show running-config static" - can you post that as well as any global statements? Or follow this link cisco.com/en/US/docs/security/asa/asa82/configuration/guide/… and see if that helps you out. – TheCleaner Jun 10 '13 at 19:35
  • 1
    t1shopper.com/tools/port-scan - try there to confirm. You will at a minimum get a connection request on the external interface in your debug logs and should be able to use that to help debug. Do you have globals setup? Did you check the URL guide link? – TheCleaner Jun 10 '13 at 20:16

In your static rules, don't use interface. Use your public IP instead.

  • static (inside,outside) tcp [Public IP] 443 [Internal IP] 443 netmask tells me that "Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address." – CmdrMoozy Jun 10 '13 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.