You're almost there Ryan. If you're using the web-interface (best web-int in the market in my opinion) when in the Security Zones, Public, Add Policy to Zone - select Port Forward and then Forward only traffic specified below with port translation.
Configure it as you would and you should end up with something like:
! ip access-list extended wizard-pfwd-3 remark Port Forward 3 permit tcp any host 121.50.211.62 eq 5020 log ! ip access-list extended wizard-pfwd-4 remark Port Forward 4 permit tcp any host 121.50.211.62 eq 5021 log ! ip policy-class Private allow list self self nat source list wizard-ics interface ppp 1 overload ! ip policy-class Public nat destination list wizard-pfwd-1 address 192.168.11.23 port 3389 nat destination list wizard-pfwd-2 address 192.168.11.23 port 3389 nat destination list wizard-pfwd-3 address 192.168.11.27 port 3389 nat destination list wizard-pfwd-4 address 192.168.11.28 port 3389 !
The only bit missing from your config is that 'port 3389' after the nat destination.
