cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
11293
Views
5
Helpful
2
Replies

ERROR: NAT unable to reserve ports.: HTTPS

Fabian Scott
Level 1
Level 1

I'm getting an error when trying to direct HTTPS to a specific IP. 

object network HTTPS
host 10.10.100.11
nat (inside,outside) static interface service tcp 443 443

ERROR: NAT unable to reserve ports

I do have AnyConnect VPN setup using SSL (FYI). I'm a bit new to cisco. I'm more of a self leaner. Please help. Thanks

1 Accepted Solution

Accepted Solutions

Hello Fabian,

I hope you are fine, the ASA is unable to reserve the ports, because port 443 is already in use by either ASDM if you have it enabled or for your  vpn connections, for that reason the firewall is unable to assign port 443 to your host.

You can however change the mapping port for external connections to another port, 4443 for example.

object network HTTPS
host 10.10.100.11
nat (inside,outside) static interface service tcp 443 4443

When your outside host try to reach the internal host, remember to type in the web browser the following:

Https://x.x.x.x:4443 where x.x.x.x is the public ip of your internal host 

Please note that when the packet arrives to the ASA he will translate port 4443 to 443, which is the port that your internal host is listening to.

Hope this helps!

Kornelia Gutierrez

View solution in original post

2 Replies 2

Hello Fabian,

I hope you are fine, the ASA is unable to reserve the ports, because port 443 is already in use by either ASDM if you have it enabled or for your  vpn connections, for that reason the firewall is unable to assign port 443 to your host.

You can however change the mapping port for external connections to another port, 4443 for example.

object network HTTPS
host 10.10.100.11
nat (inside,outside) static interface service tcp 443 4443

When your outside host try to reach the internal host, remember to type in the web browser the following:

Https://x.x.x.x:4443 where x.x.x.x is the public ip of your internal host 

Please note that when the packet arrives to the ASA he will translate port 4443 to 443, which is the port that your internal host is listening to.

Hope this helps!

Kornelia Gutierrez

Very well explained. Thx!!!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card