Solved

how to open a port 389 on cisco asa 5520 firewall for an email encryption server

Posted on 2010-08-30
12
2,426 Views
Last Modified: 2012-05-10
I have a email encryption server that sits on a DMZ and i need to open a ldap port (389) on my ASA 5520. There is a NAT rule made (static 192.168.X.X = outside 209.149.X.X) I'm just not sure how to open this port up. Thanks

Dave
0
Comment
Question by:davecordova7
  • 5
  • 3
  • 2
  • +2
12 Comments
 
LVL 4

Expert Comment

by:Zupreme
ID: 33560568
access-list ACLNAME extended permit tcp SOURCE_ADDR eq 389 host 192.168.x.x eq 389
0
 
LVL 5

Expert Comment

by:jlanderson1
ID: 33560587
access-list ACLNAME permit ip HOST LDAP host 192.168.x.x eq LDAP
0
 
LVL 17

Expert Comment

by:Kvistofta
ID: 33560927
Zupreme: i doubt that ldap uses port 389 as source port as well as destination port. Davecordova7: go with the command that janderson1 recommends.

/Kvistofta
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:davecordova7
ID: 33561495
forgive me, i'm new to ASDM. So do I need to go to ACL Manager and add an ACL?
ex.
source=LDAP server
Desination = 192.168.XX
service = ip
action= permit

thanks
dave
0
 
LVL 17

Expert Comment

by:Kvistofta
ID: 33561529
service = tcp/389

/Kvistofta
0
 
LVL 9

Expert Comment

by:gavving
ID: 33562206
In ASDM to edit an ACL:
- Go into Configuration
- click on Firewall button on the left hand side
- Select Access Rules

You'll see listed the ACL's in use.  Look for the rules listed under the 'outside' interface
click on "+Add"

Interface: outside
Action: Permit
Source: Any
Destination: 209.149.x.x
Service: tcp/ldap

This allows full internet access into your server on LDAP port.  Assuming you have a NAT rule configured as you indicated.  
0
 

Author Comment

by:davecordova7
ID: 33562541
Right now I have an access rule...
outside
source= any
Destination 209.149.X.X
service= tcp/https (to allow external users to access the Email encryption server which is on a DMZ)

I tried adding additional service like tcp/https, tcp/ldap. It was unsuccessful.

there is no ldap on the DMZ, so i'm wondering what rule is need to reach the LDAP server without a having a hole for hackers?

thanks.
dave

0
 
LVL 9

Expert Comment

by:gavving
ID: 33563117
What exactly is it that you're trying to do?  You have an Email encryption server in the DMZ. Did you want to allow LDAP queries from the Internet to that server?  That's what your question seemed to be asking.  

I assume you want it to make LDAP queries to an internal server that is not on the DMZ but is on the Inside network?  Can you provide a copy of the config so that we can be precise in what changes are needed?

0
 

Author Comment

by:davecordova7
ID: 33578183
correct.
how do i get the config for you to see.
Thanks.
0
 

Author Comment

by:davecordova7
ID: 33579260
on the ASA monitoring, i'm getting this
2      Sep 01 2010      13:12:46      106001      192.168.X.X      10.111.X.X       Inbound TCP connection denied from 192.168.X.X/53358 to 10.111.X.X/389 flags SYN  on interface dmz
0
 
LVL 9

Accepted Solution

by:
gavving earned 125 total points
ID: 33579864
Add an Access rule under the 'dmz' Interface in the firewall tab.
interface: dmz
action: permit
source: 192.168.x.x
destination: 10.111.x.x
port: tcp/ldap

Try it and see if it works.  If not then you'll also need a NAT rule that allows access from the dmz network to the inside network.  Under acl manager look for a ACL that says something about "nat0".  Add a rule to that:
action: permit
protocol: IP
source: 192.168.x.x
destination: 10.111.x.x

If you're still having problems get a copy of the config by:
Click on Tools pull down menu
Choose Command Line Interface
type "show run" as the command and click on "send"
Copy and paste the output.
0
 

Author Comment

by:davecordova7
ID: 33580346
thanks gavving, will give it a shot.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Intermittent issue reaching a Chinese website. 2 64
ipsec tunnel between two small offices, best lowcost equipment 56 156
jump server vs push server 6 166
VIRTUAL NETWORKING 3 62
We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
Optimal Xbox 360 connectivity requires "OPEN NAT". If you use Juniper Netscreen or SSG firewall products in a home setting, the following steps will allow you get rid of the dreaded warning screen below and achieve the best online gaming environment…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question