Solved

etting up Cisco ASA 5505 for multiple external IPs

Posted on 2008-10-08
13
1,120 Views
Last Modified: 2013-11-16
I am replacing an old Raptor firewall with a Cisco ASA5505. The client has several exteral IP (actually 1/2 of a class c license but he is only using about 4-5 external IP's.

I need to forward port 3389 from xxx.yyy.zzz.18  to an in internal ip of 192.168.1.18

and another forward ftp from for xxx.yyy.zzz.31 to 192.168.1.31

Can I do that from the graphical interface, or do I need to do the command line?
0
Comment
Question by:911bob
  • 8
  • 5
13 Comments
 
LVL 32

Expert Comment

by:harbor235
ID: 22668600


AS long as the network services are unique and they map to unique servers then you can use PAT or overload NAT using only the single outside interface IP for all services. However, if you need to use
similar services like http on multiple devices then you can use multiple public IPs and perfrorm static nat translations.

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)

harbor235 ;}

 
0
 

Author Comment

by:911bob
ID: 22668780
So for static I should use?:

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22668993


This is an overload NAT config, so yes this allows for any source IP to connect to the outside IP for the FW and redirect 3389 to internal server 192.168.1.18 and 21 to 192.168.1.31.

harbor235 ;}

0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 

Author Comment

by:911bob
ID: 22669642
I need to do similar services on multiple devices so we can use multiple public IPs and perfrorm static nat translations

what are those commands?

here is my current config. It does not get through using the public IP XXX.YYY.ZZZ.51 either

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name XXX.YYY.ZZZ.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name XXX.YYY.ZZZ.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name XXX.YYY.ZZZ.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address XXX.YYY.ZZZ.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside_in extended permit tcp any interface outside eq 3389
access-list outside_in extended permit tcp any interface outside eq ftp
access-list outside_access_in extended permit tcp any host TS-Inside eq 3389
access-list outside_access_in extended permit tcp any host DELL-FTP-Server-Inside eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list outside extended permit tcp any host FTP eq ftp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp interface ftp DELL-FTP-Server-Inside ftp netmask 255.255.255.255
static (inside,outside) tcp interface 3389 TS-Inside 3389 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 XXX.YYY.ZZZ.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53d9e081ca215c36b0ed47be14500780
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

0
 
LVL 32

Expert Comment

by:harbor235
ID: 22669843


Just use the static commands with the external IPs and ACLs entries to allow the traffic. AS far as NAT goes craft the NONAT ACL that I gave you above and create entries for the servers you do not want to be overload NAT'd. Then add the static commands with the specific outside IPs

Example, use overload NAT but use a seperate Public IP for RDP server
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip host 192.168.1.18 any (do not nat the RDP server)
static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
access-list outside permit tcp any host <PUBLIC_IP> eq 3389   (try to limit the source if possible)

Found a typo in my first config post, here it is again;

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface 3389 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)


harbor235 ;}
0
 

Author Comment

by:911bob
ID: 22677357
This line gives me an error

static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255

Result of the command: "static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.255.255"

static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.25                         ^5.255

ERROR: % Invalid Hostname



If I use
static (inside,outside) tcp <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
It takes it, but it also does not work
0
 

Author Comment

by:911bob
ID: 22677379
Complete listing below:

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name xxx.yyy.zzz.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name xxx.yyy.zzz.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name xxx.yyy.zzz.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address xxx.yyy.zzz.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside extended permit tcp any host FTP eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list NONAT extended permit ip host TS-Inside any
access-list NONAT extended permit ip host DELL-FTP-Server-Inside any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp TS-Outside 3389 TS-Inside 3389 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 xxx.yyy.zzz.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:c1b426d8cff31757ae0a96ed94a5b5c0
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

0
 
LVL 32

Expert Comment

by:harbor235
ID: 22677874


Right, gave you an error because the static command had IP instead of TCP, 3389 is not a valid IP port.
Is all else ok?

harbor235 ;}
0
 

Author Comment

by:911bob
ID: 22678274
Still cannot get static to work, so I reverted back to NAT for now, but since I have users on I have to leave as is for now.

I will try again tonight / tomorrow morning and let you know how I make out.
0
 

Author Comment

by:911bob
ID: 22715974
I have it so the Overloaded NAT is working, but I need to get a few other IP's forwareded to different machines.

There are 3 machnes I need to get to using port 3389, I have the most important one working with the Overloaded NAT, but what do i add / change to be able to forward x.x.x.17 to 192.168.1.17 and x.x.x.199 to 192.168.1.199? while still having the original x.x.x.50 to to 192.168.1.18

Thanks
0
 
LVL 32

Accepted Solution

by:
harbor235 earned 500 total points
ID: 22716896


If you have 3 machines that need port 3389 and NAT then we will need additional external IPs for that;

static (inside,outside) tcp <new_outside_ip_1>  3389 192.168.1.X1 3389 netmask 255.255.255.255
static (inside,outside) tcp <new_outside_ip_2>  3389 192.168.1.X2 3389 netmask 255.255.255.255

Rememebr you will an ACL entry for the new addresses as well;

access-list outside permit tcp any host  <new_outside_ip_1> eq 3389
ip access-group outside in interface outside

harbor235 ;}



0
 

Author Comment

by:911bob
ID: 22829834
harbor235, I have not forgot you, just have not had time to setup the other redirects as you listed. Hiope to do that this weekend.. Thanks for your patience,
0
 

Author Closing Comment

by:911bob
ID: 31504182
Thanks for your help..
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question