Well, you nailed it again. I did find a little feature in the ASDM that is called "public server". It appeared to be similar to what I wanted to do.
I followed what you advised there, but experimented in the ASDM as well and found that it matched what I was doing manually, including being able to use the port group I'd created.
Odd that it's done there and not in NAT as I'd prefer to not translate ALL ports and protocols but ONLY those directly related to my project as in my mind if the others aren't even translated at all, then if the access list is bad or off or somehow removed or modified, no big deal as the NAT or PAT would not translate those other ports so nothing could get to the server anyway, it wouldn't know where to find it!
So to me, doing this ALL through NAT is far more secure, safer. If it can't find the server, it can't touch the server. This method of doing it is more like putting the server on display but locking the windows. You can see it, you can get translated to and from it, but we'll not let you touch it. Look, but don't touch. I'd rather say "ha ha ha - you can't even see it! You don't even know it exists!
And this is even MORE odd because if it was a SINGLE protocol or port, say it was a WEB server, I could NAT the address and tell it port 80 to port 80 and pretty much be done. But since it's more than 1 port, because it's 2 ports, I can't do it in NAT. Well, I could by defining TWO objects, I could call it "server1 ip x.x.x.x port 80 port 80" and then define a second object "server2 ip x.x.x.x port 443 port 443" for example.
And I can define both objects just like that, sort of, and I can NAT each address/port to the SAME object, but I can't do it with a single object and single NAT. I could if it was a PORT RANGE, making this even more odd that Cisco won't allow 2 ports.
So I can create 2 objects, point BOTH objects to the exact same IP address or server, then NAT the same addresses, but a different port using 2 NAT, or I can NAT using a range like 80-443 for example and be done with it in a single object, single NAT. But since the two ports aren't contiguous, I can't do it at one NAT even with an object group.
And that's what threw me - there is absolutely no logic in that! There's no logic in allowing me to define multiple ports using a range, allowing me to create and define two objects, both of which point to the same IP/server and do it that way, and I can create an object group with multiple ports, but the NAT won't use the group. That's rather bizarre to me.
So I have the second outside IP address defined as an object, and I have the server NIC address defined as an object,
I have the ports each defined, and then a group defined using the port objects,
Later there is an access list like this that will use the ports group:
access-list WAN_access extended permit object-group vpn-ports any object vpn_gateway
Then below that, there is:
object network vpn_gateway
nat (inside,WAN) static vpn-out
access-group WAN_access in interface WAN
This is how the ASDM put it, not in the same order as you had it, and not how I was putting things manually but the way things are ordered in the configuration is still a mystery to me with all the this before that and so on.
I think what helped to confuse me was all of the other posts and articles on the web speaking to this same sort of topic - and the fact that a lot of them had the versions mixed up. I'd read a question where someone had 8.3 or later, but a response would come back which I later discovered wasn't for that version but was for 8.2 for example. Then I'd read posts about doing this exact same thing in 8.2 and someone would pop in and toss a totally different code into the mix which I later discovered was part for 8.2 and part for 8.3 and wouldn't work at all because of the mixing. So bottom line, too much of what's out there on this exact topic is not correct, or not TOTALLY correct, because people are failing to READ what the original question posted had as the VERSION Amazing how folks coming in to help fail to catch the VERSION the person with the question is running and they continue on as if the world is using the same version they are. (I see that on our car forum daily - no one bothered to read that it was a 6 cylinder and not a V8 so they go on as if they have it covered....wrong engine folks ;-) )
Thanks - it isn't kicking errors, I've not had a chance to TEST yet, but it does seem to make sense now and your response makes sense compared to what I know now.
(Now to figure out how to add a second subnet to the existing server for internal use without confusing things!)
