Cisco ASA IP object vs TCP/UDP object wrt VPN Filters

The reason why the port forwarding is not working with the access-list applied to the interface is quite simple.

Let's see what happens when the outside client requests the https webpage.

The destination port in the request packet is 443, while the source port is random. This request gets translated by nat at the router, then goes all the way to the server, server answers with the packet sourced from port 443 and destined to that client's random number port.

The packet in its journey back to the client gets to your router, but router wouldn't let the packet leave, because the destination port (that random port) is not specified in the access-list you have created.

And that would be the reason you are looking for.

If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following:

Create an object-group service, but don't specify tcp-udp after you name it.

Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination port.

Then you can use that object-group after your permit/deny command when you create your ACL.

Here is what I setup in my lab:

object-group service LabTest
     service-object udp destination eq domain
     service-object tcp-udp destination eq www

access-list TestACL extended permit object-group LabTest any any

When you do a "show access-list TestACL" the following will show:

access-list TestACL line 1 extended permit object-group LabTest any any (hitcnt=0) 
access-list TestACL line 1 extended permit udp any any eq domain (hitcnt=0) 
access-list TestACL line 1 extended permit tcp any any eq www (hitcnt=0) 
access-list TestACL line 1 extended permit udp any any eq www (hitcnt=0) 

since my service-object for destination www was tcp-udp it created 2 lines in my ACL.

I used the following link to help create my lab: Using and Configuring PIX/ASA/FWSM Object Groups