Source port translation from external tcp 3390 to internal tcp 3389 :

It appears when connecting to RDP on 3390, it will hit the Nat rule first which will translate it from 3390 to 3389, from here it will hit the ACL rule “OUTSIDE_access_in” on incoming translation destination port of tcp 3389.

So in theory the tcp 3389 will need to be configured as below on the OUTSIDE firewall rule-set as coming in from the internet.

 

Network Object :

object network RDP_SERVER_20.4
nat (MEDIA,OUTSIDE) static interface service tcp 3389 3390


Service Object :

object-group service RDP_SERVER_20.4_tcp_in tcp
port-object eq 3389
!
OUTSIDE Access in :
access-list OUTSIDE_access_in extended permit tcp any object RDP_SERVER_20.4 object-group RDP_SERVER_20.4_tcp_in
!