Solved

Configure ASA \ PIX firewall to allow ssh to a specific device

Posted on 2008-06-13
5
1,430 Views
Last Modified: 2013-11-16
How  do I allow or forward ssh connections to a specific device with the ASA. I have the the following setup. I know how to forward the incomming SSH traffic on the ISA but need help with the ASA. I would like to forward any SSH connections from the external ip 70.45.3.12 to the internal server 192.168.0.25. I need the ASA to get he traffic to the ISA and the ISA will forward to the server. Thanks in advance

*Internet - USER*
70.45.3.12
        |
        |
15.48.16.106
*CISCO ASA*
172.16.14.2
         |
         |  
172.16.14.1
*ISA Firewall *
192.168.0.10
        |
        |
192.168.0.25
*Server *
0
Comment
Question by:ctna
  • 3
  • 2
5 Comments
 
LVL 16

Expert Comment

by:btassure
ID: 21783361
From the command line:

Create the static NAT rule:
static (inside,outside) tcp 15.48.16.106 ssh 172.16.14.1 ssh netmask 255.255.255.255

Create an ACL to allow access:
access-list outside_access_in (you may need to check the name of the currently used ACL and use that instead - do a show run and see what access-group the outside interface is using) extended permit tcp host 70.45.3.12 (replace with "host x.x.x.x" with "any" if you want anyone to be able to access it) host 15.48.16.106 eq ssh

In summary:
static (inside,outside) tcp 15.48.16.106 ssh 172.16.14.1 ssh netmask 255.255.255.255
access-list outside_access_in extended permit tcp host 70.45.3.12 host 15.48.16.106 eq ssh


0
 
LVL 1

Author Comment

by:ctna
ID: 21792862
If I have another IP do I Add another access list for that IP?
0
 
LVL 1

Author Comment

by:ctna
ID: 21792902
Also, if you wanted to direct all traffic to the 172.16.14.1 interface would I add this NAT rule instead? Just want to make sure I understand..

static (inside,outside) 15.48.16.106 172.16.14.1 netmask 255.255.255.255
0
 
LVL 16

Accepted Solution

by:
btassure earned 500 total points
ID: 21795459
Yes, that rule would NAT ALL traffic to that inside address, you would still need to set up access lists for that as well.

If you wanted another IP to be able to SSH in you have to add it to the ACL you already created, not create a new one.
0
 
LVL 1

Author Closing Comment

by:ctna
ID: 31467006
thanks for the help
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cheap Gigabit Switch with trunking support for iSCSI and ethernet connections. 3 66
Read-only SNMP string example ? 7 73
Mac-address sticky 12 46
esx multi vlans 3 58
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now