Port forwarding should only be configured in the form of a dst-nat ACL on the wired port of a controller that is a public interface.
For example, if the wired physical port of a controller has a public address of 24.34.223.118 and you have an internal host (192.168.1.20) that needs to be reached on port 80, you would do the following;
config t
ip access-list session "port-forward"
any host 24.34.223.118 any dst-nat ip 192.168.1.20 80 queue low
exit
vlan 20
interface vlan 20
ip address 24.34.223.118 255.255.255.192
exit
interface gigabitethernet 2/0
switchport mode access
switchport access vlan 20
ip access-group "port-forward" session
exit