About asa V8.4 nat service port use destination or source

Question

hi ,
my inside web-server  192.168.1.1 8080 nat outside ip add 61.X.X.X 8080 .
object service real_svc8088
service tcp destination eq 8088
object service mapped_svc8088
service tcp destination eq 8088
nat (inside,ouside) source static local-1-1 remote-lan4 service real_svc8080 mapped_svc8088
   is my object service use  service tcp destination eq 8088  or  service tcp source eq 8088?
i think  service tcp destination eq 8088 is right,but not right。
why ?
sorry ,write error.
all port is 8088
nat (inside,ouside) source static local-1-1 remote-lan4 service real_svc8088 mapped_svc8088

Answer 1

Hi,
Again, you mention port TCP/8080 but your configurations mention TCP/8088
There are 2 different ways to accomplish the Static PAT (Port Forward) configuration
The more typical that I use is
object network STATIC-PAT
  host 192.168.1.1
  nat (inside,outside) static service tcp 8080 8080
The one you are using should look like this
object network MAPPED-IP
  host
object network LOCAL-IP
  host
object service TCP8080
  service tcp source eq 8080
nat (inside,outside) source static LOCAL-IP MAPPED-IP service TCP8080 TCP8080
I already mentioned the reason to use "source" instead of "destination".
First look at the format of the actual NAT command
nat (sourceint,destinationint) source static destination static service
The NAT configuration has its source parameters after the "source static" section. So if we want to modify the "source" sections REAL/MAPPED ports/services then we mention "source" in the "object service".
The "source" and "destination" in the "nat" command doesnt refer to the direction of the connection. I am not sure how to clearly describe it.
The main thing is not to mix up the "nat" commands "source" and "destination" with the same thing in the ACL/access-list configurations.
Your example
hostname(config-service-object)# service tcp source eq www destination eq ssh
Doesnt really mean anything by itself. It just defines the source and TCP/80 and destination as TCP/22. It depends where you use it.
If you used it in an ACL then it would mean that the source port for that rule would be TCP/80 and the destination port would be TCP/22 which I dont see as logical for an ACL rule. It doesnt seem logical to be used in a NAT configuration either.
If you used it in a NAT configuration then it would define the "source" real or mapped service as TCP/80 and the "destination" real or mapped service as TCP/22. Whether it means real or mapped again depends on where you have used the "object service" that contains this information. I mean if you have used the "object service" as the mapped or real "object" (Refer to the above format of the NAT configuration)
Hope this helps
Please do remember to mark replys as the correct answer if they answered your question.
- Jouni