• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 969
  • Last Modified:

CISCO ASA 5510 - IP REDIRECT

I am configuring a CISCO ASA 5510 and need to set up a redirection.

I want to translate one of the Public IP's to an internal network device IP.

Is this a static NAT route or access list.

Thanks

0
FlyingFortress
Asked:
FlyingFortress
  • 6
  • 3
  • 2
2 Solutions
 
Mystique_87Commented:
It has to be a static nat rule. Its format is as shown below:

static(inside, outside) <ipaddress1> <portno1> <ipaddress2> <portno2>

where :
<ipaddress1> is the destination ip address  of the request that appears at the outside interface
<portno1> is the destination port no of the request that appears on the outside interface
<ipaddress2> is the ip address of the internal ip address of the device to which the request is to be redirected to
<portno2> is the port no of the internal device to which the request is to be redirected to
0
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
You also need to allow inbound traffic on outside acl. In that access-list you should use the outside ip address as destination.

Like:

static (inside,outside) 1.2.3.4 192.168.1.10

or

static (inside,outside) tcp 1.2.3.4 80 1921.68.1.10 80

(Mystique87 has a syntax error above)

and!

access-l OUTSIDE ext permit tcp any host 1.2.3.4 eq 80
access-g OUTSIDE in int outside

/Kvistofta
0
 
Mystique_87Commented:
oh, I am sorry
the access-list is necessary
0
Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

 
FlyingFortressAuthor Commented:
Thanks v.Much
0
 
FlyingFortressAuthor Commented:
Hi Sorry - I thought i was there but it does not seem to work

Here is the config

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp 192.168.50.5 www 222.111.2.25 www netmask 255.255.255.255
static (inside,outside) tcp 192.168.50.5 https 222.111.2.25 https netmask 255.255.255.255
access-group inside_access_in in interface inside control-plane
access-group outside in interface outside

This is conecting to our remote support server

The outside address does not resolve?

I have checked the logs and get this - Deny IP Spoof



0
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
you need to turn your static around, swap the ip addresses.

static (inside,outside) tcp OUTSIDE-IP www INSIDE-IP www

/Kvistofta
0
 
FlyingFortressAuthor Commented:
Hi - Thanks

However, i still dont seem to be able to access the server through the IP....?

Here is a some more info..


object-group service DM_INLINE_SERVICE_1
 service-object ip
 service-object tcp eq www
 service-object tcp eq https
access-list inside_access_in extended permit ip any any
access-list outside extended permit object-group DM_INLINE_SERVICE_1 any host 222.111.2.25
pager lines 24
logging enable
logging asdm informational
mtu management 1500
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp 222.111.2.25 www 192.168.50.5 www netmask 255.255.255.255
static (inside,outside) tcp 222.111.2.25 https 192.168.50.5 https netmask 255.255.255.255
access-group inside_access_in in interface inside control-plane
access-group outside in interface outside
0
 
FlyingFortressAuthor Commented:
Here is the log from ping requests:

2      Sep 10 2010      05:28:18      106016                              Deny IP spoof from (99.20.99.150) to 222.111.2.25 on interface outside

It is saying the destination IP address is 0 ???....

Thanks
0
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
How does your routing table look like? show route

/Kvistofta
0
 
FlyingFortressAuthor Commented:
Gateway of last resort is 99.20.99.150 to network 0.0.0.0

C    99.20.99.150 255.255.255.248 is directly connected, outside
C    192.168.50.0 255.255.255.0 is directly connected, inside
C    192.168.1.0 255.255.255.0 is directly connected, management
S*   0.0.0.0 0.0.0.0 [1/0] via 99.20.99.150, outside

I can open another question if you would like points as this is spidering into seperate issues.....
0
 
FlyingFortressAuthor Commented:
The server is saying failure to detect proxy server if that is any help.

0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

  • 6
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now