davecordova7
asked on
how to open a port 389 on cisco asa 5520 firewall for an email encryption server
I have a email encryption server that sits on a DMZ and i need to open a ldap port (389) on my ASA 5520. There is a NAT rule made (static 192.168.X.X = outside 209.149.X.X) I'm just not sure how to open this port up. Thanks
Dave
Dave
Zupreme
access-list ACLNAME extended permit tcp SOURCE_ADDR eq 389 host 192.168.x.x eq 389
access-list ACLNAME permit ip HOST LDAP host 192.168.x.x eq LDAP
Zupreme: i doubt that ldap uses port 389 as source port as well as destination port. Davecordova7: go with the command that janderson1 recommends.
/Kvistofta
/Kvistofta
ASKER
forgive me, i'm new to ASDM. So do I need to go to ACL Manager and add an ACL?
ex.
source=LDAP server
Desination = 192.168.XX
service = ip
action= permit
thanks
dave
ex.
source=LDAP server
Desination = 192.168.XX
service = ip
action= permit
thanks
dave
service = tcp/389
/Kvistofta
/Kvistofta
In ASDM to edit an ACL:
- Go into Configuration
- click on Firewall button on the left hand side
- Select Access Rules
You'll see listed the ACL's in use. Look for the rules listed under the 'outside' interface
click on "+Add"
Interface: outside
Action: Permit
Source: Any
Destination: 209.149.x.x
Service: tcp/ldap
This allows full internet access into your server on LDAP port. Assuming you have a NAT rule configured as you indicated.
- Go into Configuration
- click on Firewall button on the left hand side
- Select Access Rules
You'll see listed the ACL's in use. Look for the rules listed under the 'outside' interface
click on "+Add"
Interface: outside
Action: Permit
Source: Any
Destination: 209.149.x.x
Service: tcp/ldap
This allows full internet access into your server on LDAP port. Assuming you have a NAT rule configured as you indicated.
ASKER
Right now I have an access rule...
outside
source= any
Destination 209.149.X.X
service= tcp/https (to allow external users to access the Email encryption server which is on a DMZ)
I tried adding additional service like tcp/https, tcp/ldap. It was unsuccessful.
there is no ldap on the DMZ, so i'm wondering what rule is need to reach the LDAP server without a having a hole for hackers?
thanks.
dave
outside
source= any
Destination 209.149.X.X
service= tcp/https (to allow external users to access the Email encryption server which is on a DMZ)
I tried adding additional service like tcp/https, tcp/ldap. It was unsuccessful.
there is no ldap on the DMZ, so i'm wondering what rule is need to reach the LDAP server without a having a hole for hackers?
thanks.
dave
What exactly is it that you're trying to do? You have an Email encryption server in the DMZ. Did you want to allow LDAP queries from the Internet to that server? That's what your question seemed to be asking.
I assume you want it to make LDAP queries to an internal server that is not on the DMZ but is on the Inside network? Can you provide a copy of the config so that we can be precise in what changes are needed?
I assume you want it to make LDAP queries to an internal server that is not on the DMZ but is on the Inside network? Can you provide a copy of the config so that we can be precise in what changes are needed?
ASKER
correct.
how do i get the config for you to see.
Thanks.
how do i get the config for you to see.
Thanks.
ASKER
on the ASA monitoring, i'm getting this
2 Sep 01 2010 13:12:46 106001 192.168.X.X 10.111.X.X Inbound TCP connection denied from 192.168.X.X/53358 to 10.111.X.X/389 flags SYN on interface dmz
2 Sep 01 2010 13:12:46 106001 192.168.X.X 10.111.X.X Inbound TCP connection denied from 192.168.X.X/53358 to 10.111.X.X/389 flags SYN on interface dmz
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
thanks gavving, will give it a shot.