In this example I will be opening port 3389 to a VM called RDP-Machine (192.168.2.200) There are two steps when creating a port forward:
1) NAT Policy
Go to: Firewall -> Objects -> Network Objects/Groups -> Add -> Network Object
2) Create Access Rule
Firewall -> Access Rules -> Add Access Rule
Note: You may need to add RDP as service.
The following config was added to the config
object network RDP-Machine host 192.168.2.200 access-list outside_access_in extended permit object RDP any any object network RDP-Machine nat (any,outside) static interface service tcp 3389 3389