So, as I said, you can mostly accomplish what you want (minus an actual object-group to reference in a single NAT statement). You'll need to create multiple objects all pointed to the same host IP address, but named differently; this will allow you to map multiple ports to the same host without mapping ALL ports and protocols to said host (it will only map the specific ports/protocols). So, please add: object network Scomage-ESET-2222 host 10.10.100.11 nat (inside,outside) static IP_147 service tcp 2222 2222 ! object network Scomage-ESET-2223 host 10.10.100.11 nat (inside,outside) static IP_147 service tcp 2223 2223 ! object network Scomage-ESET-3128 host 10.10.100.11 nat (inside,outside) static IP_147 service tcp 3128 3128 ! object network Scomage-ESET-8443 host 10.10.100.11 nat (inside,outside) static IP_147 service tcp 8443 8443 !