Solved

etting up Cisco ASA 5505 for multiple external IPs

Posted on 2008-10-08
13
1,118 Views
Last Modified: 2013-11-16
I am replacing an old Raptor firewall with a Cisco ASA5505. The client has several exteral IP (actually 1/2 of a class c license but he is only using about 4-5 external IP's.

I need to forward port 3389 from xxx.yyy.zzz.18  to an in internal ip of 192.168.1.18

and another forward ftp from for xxx.yyy.zzz.31 to 192.168.1.31

Can I do that from the graphical interface, or do I need to do the command line?
0
Comment
Question by:911bob
  • 8
  • 5
13 Comments
 
LVL 32

Expert Comment

by:harbor235
ID: 22668600


AS long as the network services are unique and they map to unique servers then you can use PAT or overload NAT using only the single outside interface IP for all services. However, if you need to use
similar services like http on multiple devices then you can use multiple public IPs and perfrorm static nat translations.

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)

harbor235 ;}

 
0
 

Author Comment

by:911bob
ID: 22668780
So for static I should use?:

static (inside,outside) tcp interface ftp 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22668993


This is an overload NAT config, so yes this allows for any source IP to connect to the outside IP for the FW and redirect 3389 to internal server 192.168.1.18 and 21 to 192.168.1.31.

harbor235 ;}

0
 

Author Comment

by:911bob
ID: 22669642
I need to do similar services on multiple devices so we can use multiple public IPs and perfrorm static nat translations

what are those commands?

here is my current config. It does not get through using the public IP XXX.YYY.ZZZ.51 either

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name XXX.YYY.ZZZ.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name XXX.YYY.ZZZ.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name XXX.YYY.ZZZ.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address XXX.YYY.ZZZ.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside_in extended permit tcp any interface outside eq 3389
access-list outside_in extended permit tcp any interface outside eq ftp
access-list outside_access_in extended permit tcp any host TS-Inside eq 3389
access-list outside_access_in extended permit tcp any host DELL-FTP-Server-Inside eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list outside extended permit tcp any host FTP eq ftp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp interface ftp DELL-FTP-Server-Inside ftp netmask 255.255.255.255
static (inside,outside) tcp interface 3389 TS-Inside 3389 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 XXX.YYY.ZZZ.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53d9e081ca215c36b0ed47be14500780
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

0
 
LVL 32

Expert Comment

by:harbor235
ID: 22669843


Just use the static commands with the external IPs and ACLs entries to allow the traffic. AS far as NAT goes craft the NONAT ACL that I gave you above and create entries for the servers you do not want to be overload NAT'd. Then add the static commands with the specific outside IPs

Example, use overload NAT but use a seperate Public IP for RDP server
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip host 192.168.1.18 any (do not nat the RDP server)
static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
access-list outside permit tcp any host <PUBLIC_IP> eq 3389   (try to limit the source if possible)

Found a typo in my first config post, here it is again;

So for overload NAT do the following;

global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1  192.168.1.0 255.255.255.0

access-list NONAT permit ip x.x.x.x y.y.y.y.y a.a.a.a b.b.b.b (ex:for traffic you do not want to NAT, may not  
                                                                                                   any, there just in case you do

static (inside,outside) tcp interface 3389 192.168.1.18 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.1.31 21 netmask 255.255.255.255
ftp mode passive
access-list outside permit tcp any host xx.yy.zz.18 eq 3389   (try to limit the source if possible)
access-list outside permit tcp any host xx.yy.zz.18 eq 21       (try to limit the source if possible)


harbor235 ;}
0
 

Author Comment

by:911bob
ID: 22677357
This line gives me an error

static (inside,outside) ip <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255

Result of the command: "static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.255.255"

static (inside,outside) ip xxx.yyy.zzz.18 3389 192.168.1.18 3389 netmask 255.255.25                         ^5.255

ERROR: % Invalid Hostname



If I use
static (inside,outside) tcp <PUBLIC_IP> 3389 192.168.1.18 3389 netmask 255.255.255.255
It takes it, but it also does not work
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 

Author Comment

by:911bob
ID: 22677379
Complete listing below:

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name hillary.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name xxx.yyy.zzz.31 FTP description Dell FTP Server
name 192.168.1.2 HP9000 description HP9000 Inside
name xxx.yyy.zzz.2 HP9000-Outside description HP9000 From Outside
name 192.168.1.18 TS-Inside description W2K Terminal Server
name xxx.yyy.zzz.18 TS-Outside description W2K Terminal Server
name 192.168.1.31 DELL-FTP-Server-Inside
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address xxx.yyy.zzz.51 255.255.255.128
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.0.31 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 198.6.1.4
 name-server 198.6.1.3
 domain-name hillary.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service FTP tcp
 description Ftp Service Group
 port-object eq ftp
object-group service TerminalServer tcp
 port-object eq 3389
access-list outside extended permit tcp any host FTP eq ftp
access-list outside extended permit tcp any host TS-Outside eq 3389
access-list NONAT extended permit ip host TS-Inside any
access-list NONAT extended permit ip host DELL-FTP-Server-Inside any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,dmz) tcp interface ftp FTP ftp netmask 255.255.255.255
static (inside,outside) tcp TS-Outside 3389 TS-Inside 3389 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 xxx.yyy.zzz.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd dns 198.6.1.4 198.6.1.3 interface inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:c1b426d8cff31757ae0a96ed94a5b5c0
: end
asdm image disk0:/asdm-524.bin
asdm location HP9000-Outside 255.255.255.255 inside
asdm location HP9000 255.255.255.255 inside
asdm location DELL-FTP-Server-Inside 255.255.255.255 inside
no asdm history enable

0
 
LVL 32

Expert Comment

by:harbor235
ID: 22677874


Right, gave you an error because the static command had IP instead of TCP, 3389 is not a valid IP port.
Is all else ok?

harbor235 ;}
0
 

Author Comment

by:911bob
ID: 22678274
Still cannot get static to work, so I reverted back to NAT for now, but since I have users on I have to leave as is for now.

I will try again tonight / tomorrow morning and let you know how I make out.
0
 

Author Comment

by:911bob
ID: 22715974
I have it so the Overloaded NAT is working, but I need to get a few other IP's forwareded to different machines.

There are 3 machnes I need to get to using port 3389, I have the most important one working with the Overloaded NAT, but what do i add / change to be able to forward x.x.x.17 to 192.168.1.17 and x.x.x.199 to 192.168.1.199? while still having the original x.x.x.50 to to 192.168.1.18

Thanks
0
 
LVL 32

Accepted Solution

by:
harbor235 earned 500 total points
ID: 22716896


If you have 3 machines that need port 3389 and NAT then we will need additional external IPs for that;

static (inside,outside) tcp <new_outside_ip_1>  3389 192.168.1.X1 3389 netmask 255.255.255.255
static (inside,outside) tcp <new_outside_ip_2>  3389 192.168.1.X2 3389 netmask 255.255.255.255

Rememebr you will an ACL entry for the new addresses as well;

access-list outside permit tcp any host  <new_outside_ip_1> eq 3389
ip access-group outside in interface outside

harbor235 ;}



0
 

Author Comment

by:911bob
ID: 22829834
harbor235, I have not forgot you, just have not had time to setup the other redirects as you listed. Hiope to do that this weekend.. Thanks for your patience,
0
 

Author Closing Comment

by:911bob
ID: 31504182
Thanks for your help..
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now