Конфиг:
: Saved
: Written by enable_15 at 10:02:22.291 UTC Thu Jun 25 2009
!
ASA Version 7.2(4)
!
hostname gw
domain-name gw.local
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.3.5 Printer
name 62.34.59.189 kc
name 81.13.215.34 Local_out
name 192.168.3.61 RDP1
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address Local_out 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name gw.local
object-group service Printer tcp
port-object eq 9100
object-group service rdp tcp
port-object eq 3389
object-group service rdp_kc tcp
port-object eq 65003
access-list outside_access_in extended permit tcp kc 255.255.255.240 host Local_out object-group Printer
access-list outside_access_in extended permit tcp kc 255.255.255.240 host Local_out eq www
access-list inside_nat_static extended permit tcp host RDP1 eq 3389 kc 255.255.255.240
access-list inside_nat_outbound extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
asdm location Printer 255.255.255.255 inside
asdm location kc 255.255.255.240 inside
asdm location Local_out 255.255.255.255 inside
asdm location RDP1 255.255.255.255 inside
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 access-list inside_nat_outbound
static (inside,outside) tcp interface 9100 Printer 9100 netmask 255.255.255.255
static (inside,outside) tcp interface www Printer www netmask 255.255.255.255
static (inside,inside) tcp interface 65003 access-list inside_nat_static  norandomseq
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 81.13.100.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 195.68.129.66 255.255.255.255 outside
http kc 255.255.255.240 outside
http 192.168.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.3.50-192.168.3.100 inside
dhcpd dns 194.67.160.3 194.67.161.1 interface inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:f0016682ee4351b565690a5fb0e617e9

Нужно чтобы  хост RDP1 (192.168.3.61) при обращении к кс (62.34.59.189) по 3389 порту, мапился на порт 65003. Я попытался сделать это средствами Static Policy. Вывод пакет трейсера утверждает, что мапится все нормально, но при попытке подключения клиент все так-же улетает напрямую на стандартный порт, следуя дефолтному правилу ната.

Вывод пакет трейсера:

packet-tracer input inside tcp 192.168.3.61 3389 62.34.59.189 3389

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,outside) tcp interface 65003 access-list inside_nat_static
nat-control
  match tcp inside host RDP1 eq 3389 outside kc 255.255.255.240
    static translation to Local_out/65003
    translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 access-list inside_nat_outbound
nat-control
  match ip inside any outside any
    dynamic translation to pool 1 (Local_out [Interface PAT])
    translate_hits = 27524, untranslate_hits = 186
Additional Information:
Dynamic translate RDP1/3389 to Local_out/1884 using netmask 255.255.255.255

Phase: 6
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 28334, packet dispatched to next module

Phase: 9
Type: ROUTE-LOOKUP
Subtype: output and adjacency
Result: ALLOW
Config:
Additional Information:
found next-hop 81.13.215.33 using egress ifc outside
adjacency Active
next-hop mac address 000c.f18f.7a30 hits 63642

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

Вопрос собственно в следующем -- где я ошибся? =0)