I have Cisco ASA 8.2(5) and would like to configure port forwarding.

Cisco ASA has 2 interfaces:

outside with IP
inside with IP

I have two subnets reachable through outside interface:

And two subnets reachable through inside interface:

Now I would like to setup port forwarding so, that the same port on outside interface of ASA is forwarded to different inside hosts, depending on subnet of the client outside:

  1. If client from one subnet connects from outside to ASA on port 4000 (from to, I want to forward it to
  2. If client from another subnet connects to the same port on outside interface of ASA (from to, I want to forward it to host in another subnet (

Is such configuration possible? How could I configure it?

P.S. My current configuration just always forwards the port to the same IP, not depending on client subnet:

object-group service OpenedPorts tcp-udp
 port-object eq 4000
 port-object eq 4002
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp

access-list outside_access_in extended permit object-group TCPUDP any any object-group OpenedPorts

access-group outside_access_in in interface outside

static (inside,outside) tcp interface 4000 3389 netmask
static (inside,outside) tcp interface 4002 22 netmask

ASA added Policy Based Routing in 9.4(1), with a versatile list of settings you can apply to selected traffic:

From release notes:

Policy Based Routing (PBR) is a mechanism by which traffic is routed through specific paths with a specified QoS using ACLs. ACLs let traffic be classified based on the content of the packet’s Layer 3 and Layer 4 headers. This solution lets administrators provide QoS to differentiated traffic, distribute interactive and batch traffic among low-bandwidth, low-cost permanent paths and high-bandwidth, high-cost switched paths, and allows Internet service providers and other organizations to route traffic originating from various sets of users through well-defined Internet connections.

We introduced the following commands: set ip next-hop verify-availability, set ip next-hop, set ip next-hop recursive, set interface, set ip default next-hop, set default interface, set ip df, set ip dscp, policy-route route-map, show policy-route, debug policy-route


It seems that you cannot do this on ASA.

The feature to support this is called "Policy Based Routing". But according to the following link, Cisco support this feature only on routers, but not on ASA-Devices:


  • Thanks. However, I just found that ASA supports "Policy NAT with Different Destination Ports" (cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/…). I will try it and write back. – Andrey Sapegin Jul 2 '14 at 14:44
  • 1
    This is definitely Policy NAT, not PBR... you need to write a match for the outside global and the outside local, then tell the ASA what inside local IP to translate to. Although this does sound like a homework assignment with the limited outside subnets and 192.168.x.x addresses, but I don't want to downvote in case it's just well hidden production use. – cpt_fink Jul 3 '14 at 2:40
  • It's not a homework assignment, but I'm preparing network setup for teaching. However, I still think that this question could be relevant for production use, even if in rare cases. – Andrey Sapegin Jul 3 '14 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.