We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am using ASDM to configure but I exported the pertinent parts to command line.
object network IP_147 host xxx.xxx.xxx.147 object network Scomage-ESET host 10.10.100.11 object service RDP service tcp destination eq 3389 object service ESET_2222_2223 service tcp destination range 2222 2223 object service ESET_3128 service tcp destination eq 3128 object service ESET_8443 service tcp destination eq 8443 object-group service ESET service-object tcp destination eq https service-object object ESET_2222_2223 service-object object ESET_3128 service-object object ESET_8443 access-list outside_access_in extended permit object RDP any object Scomage-CPC21 access-list outside_access_in extended permit object RDP any object Scomage-CPC22 access-list outside_access_in extended permit object RDP any object Scomage-CPC23 access-list outside_access_in extended permit object-group ESET any object Scomage-ESET object network Scomage-CPC21 nat (inside,outside) static IP_147 service tcp 3389 9401 object network Scomage-CPC22 nat (inside,outside) static IP_147 service tcp 3389 9402 object network Scomage-CPC23 nat (inside,outside) static IP_147 service tcp 3389 9403
IP_147 is the external ip I want to use for this access. Currently 9401, 9402, and 9403 route to specific internal machines port 3389. This works just fine. Unfortunately ASDM won't let me put in a group. Do I have to do it in command line? How is this best done?