Cisco ASA NAT Port Forwarding

Hello Rodrigo

When you want to configure the ASA such that hosts on the Internet will be able to access the internal devices, you must translate the internal device IP to an external IP/Port combination using a static NAT translation. Even though the traffic direction is taking place from outside to the DMZ in the specific scenario, the translation must be implemented as a translation from the private IP address of the server in question to the public IP address/port combination.

This can be seen in the example shown in this Cisco documentation as well:

The example shows the configuration applied using ASDM, but also shows the equivalent CLI commands for this at the end of the section.

But remember, such a translation is not enough. You must also include an access list that will allow the traffic from the outside to the servers to traverse the ASA.

I hope this has been helpful!

Laz