NAT Gateway

If a remote session uses a web browser on a workstation behind a NAT gateway, the gateway substitutes a global “public” address for the workstation’s real local IP address. When ACS receives the HTTP requests, the NAT device’s public IP address conflicts with the workstation’s private IP address included in the content of the HTTP requests. Cisco Secure ACS won’t allow this.

If the Cisco Secure ACS server is behind a NAT gateway, you could try to configure the NAT gateway to forward all connections to port 2002 to the Cisco Secure ACS server, retaining the port 2002. In addition, all the ports allowed using the HTTP port allocation feature must be similarly mapped. Cisco hasn’t tested this and it doesn’t support this implementation.