Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

8.3 Nat

Is it possible to configure the ASA to forward a packet with a destintion port of 80 to a destination port of 8080, without translating the original destination IP address?

Cisco Employee

Re: 8.3 Nat

Yes it is possible

Here it is for your example:

object network test
   nat (inside,outside) static service tcp 80 8080

New Member

Re: 8.3 Nat

I tried this and I get back this error message in the logs ASA-5-305013
Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src Outside: dst SF1-Interface: denied due to NAT reverse path failure

Cisco Employee

Re: 8.3 Nat

If you inside server is listening on 8080 then the example should be like this.

object network test
   nat (inside,outside) static service tcp 8080 80

Follow this link:

Regarding the syslog that you are seeing you can refer this link:

Pls. collect the output of the following:

Outside: dst SF1-Interface:

  packet-tracer input Outside tcp 11199 80 det

  packet-tracer input SF1-Interface tcp 80 11199  det

See the section towards the end where it says dropped and check the reason and the nat line that it is matching.

Post the output if you have questions.