User's Manual

Firewall
Configuring the NAT Rules to Securely Access a Remote Network
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 196
6
If the service you want is not in the list, choose Create a Service to create a
new service object. To maintain the service objects, go to the Networking -
> Service Management page. See Service Management, page 154.
• Translated IP: Choose the IP address of your local server that needs to be
translated. If the IP address you want is not in the list, choose Create an IP
Address to create a new IP address object. To maintain the IP address
objects, go to the Networking -> Address Object Management page. See
Address Management, page 152.
• WAN: Choose either WAN1 or WAN2, or both as the incoming WAN interface.
• WAN IP: Specify the public IP address of the server. You can use the WAN’s
IP address or a public IP address that is provided by your ISP. When you
choose Both as the incoming WAN interface, this option is grayed out.
• Enable Port Forwarding: Click On to enable the port forwarding rule, or click
Off to create only the port forwarding rule .
• Description: Enter the name for the port forwarding rule.
STEP 4 Click OK to save your settings.
STEP 5 Click Save to apply your settings.
Configuring Port Triggering Rules
Port triggering opens an incoming port for a specified type of traffic on a defined
outgoing port. When a LAN device makes a connection on one of the defined
outgoing ports, the security appliance opens the specified incoming port to
support the exchange of data. The open ports will be closed again after 600
seconds when the data exchange is complete.
Port triggering is more flexible and secure than port forwarding, because the
incoming ports are not open all the time. They are open only when a program is
actively using the trigger port.
Some applications may require port triggering. Such applications require that,
when external devices connect to them, they receive data on a specific port or
range of ports in order to function properly. The security appliance must send all
incoming data for that application only on the required port or range of ports. You
can specify a port triggering rule by defining the type of traffic (TCP or UDP) and
the range of incoming and outgoing ports to open when enabled.