The goal is to forward two different ports 1195 and 1196 from the outside address of the ASA to two different hosts on the inside but on the same port.

These are the addresses used in this example:

  • ASA.Internet

Here is the relevant part of the config for one inside host:

object network VPN2
 nat (DMZ,Internet) static interface service udp 1194 1195

object service VPN
 service udp destination eq 1194

access-list Internet_access_in_1 extended permit object VPN any object VPN2
access-list Internet_access_in_1 extended deny ip any any

The questions are:

  • What is the correct way to use packet tracer in this case?
  • What is the correct destination port to use in the ACL in this case?


Using packet-tracer input internet udp 1234 1194 (inside IP/port) I get

Phase: 7
Type: NAT
Subtype: rpf-check
Result: DROP
object network VPN2
 nat (DMZ,Internet) static interface service udp 1194 1195
Additional Information:

Using packet-tracer input internet udp 1234 1195 (outside IP/port) I obviously get

Phase: 4
Result: DROP
Implicit Rule
Additional Information:

In any case, packets are currently hitting the firewall on the Internet(outside) interface on udp port 1195 but they aren't seen inside. show nat detail:

  (DMZ) to (Internet) source static VPN2 interface   service udp 1194 1195
     translate_hits = 0, untranslate_hits = 0
     Source - Origin:, Translated:
     Service - Protocol: udp Real: 1194 Mapped: 1195

Now what is making me crazy in addition, if I add port 1195 to the access list, the following invocation of packet tracer accepts the traffic:

packet-tracer input internet tcp 1234 1195

That's the inside IP but the outside port? WT...?

  • I have to thank you big time for your post. I just spent two days scratching my head setting up a simple port forwarding. Can't believe Cisco made it so complicated. Anyways I was having the same issue you mention, and solved it thanks to your post. Cheers! RVa.
    – Raphaël
    Commented Dec 29, 2016 at 11:28
  • No prob. The order of statements seems to be very important (and if using static nat also if you make it bidirectional or not). This is more or less trial and error though. Also ASDM sometimes shows weird things. I guess I will take a course about NAT on the ASA next year. This is just too crazy ;-)
    – Marki
    Commented Dec 29, 2016 at 14:54

1 Answer 1


There was a manual Dynamic PAT (Hide) to any in NAT section 1. I moved it to after-auto (section 3) and all is good...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.