We currently have one Cisco ASA 5505, configured to allow RDP from internet to one server behind the firewall; we need to allow more servers to RDP directly through firewall without requiring a user to connect to our VPN. Current configuration below. How can we do this?
I have removed private info from the below config:
!
hostname asa
!
names
name xxx.xxx.xxx.xxx InterfaceIP
name xxx.xxx.xxx.xxx ISA_Outside
name xxx.xxx.xxx.xxx Sharepoint_Outside
name 8.8.8.8 googdns
name 10.0.0.70 PDC01
name 10.0.0.80 PDC02
name 10.0.0.55 rdpserver
name 10.0.0.48 feedback
!
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.0.0.0
rip send version 2
rip receive version 2
no shut
!
interface Vlan2
nameif outside
security-level 0
ip address InterfaceIP 255.255.255.248
no shut
!
interface Ethernet0/0
no shut
!
interface Ethernet0/1
switchport access vlan 2
no shut
!
interface Ethernet0/2
switchport access vlan 2
no shut
!
interface Ethernet0/3
no shut
!
!
interface Ethernet0/4
no shut
!
!
interface Ethernet0/5
no shut
!
!
interface Ethernet0/6
no shut
!
!
interface Ethernet0/7
no shut
!
!
boot system disk0:/asa804-k8.bin
asdm image disk0:/asdm-61557.bin
no asdm history enable
!
ftp mode passive
clock timezone MST -7
clock summer-time MDT recurring
!
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server PDC01
name-server googdns
!
no same-security-traffic permit inter-interface
object-group service Demigod udp
port-object range 6002 6022
access-list outside_access_in remark Allow ICMP
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any any
access-list outbound extended permit gre any any
access-list outbound extended permit tcp any any eq pptp
access-list outbound extended permit tcp any host PDC02 eq pptp
access-list acl-out extended permit gre any any
!
pager lines 24
logging enable
logging buffered informational
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
arp timeout 4400
!
cl config dhcpd
no dhcpd enable inside
dhcpd auto_config outside
!
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
!
static (inside,outside) tcp Sharepoint_Outside www App04 www netmask 255.255.255.255
static (inside,outside) tcp Sharepoint_Outside https App04 https netmask 255.255.255.255
static (inside,outside) tcp Sharepoint_Outside smtp App04 smtp netmask 255.255.255.255
static (inside,outside) tcp ISA_Outside www ISA www netmask 255.255.255.255
static (inside,outside) tcp interface 3389 rdpserver 3389 netmask 255.255.255.255
static (inside,outside) tcp interface ftp wfiftp ftp netmask 255.255.255.255
static (inside,outside) tcp interface ldap PDC01 ldap netmask 255.255.255.255
static (inside,outside) tcp interface pptp PDC01 pptp netmask 255.255.255.255
static (inside,outside) tcp ISA_Outside https rdpserver https netmask 255.255.255.255
static (inside,outside) tcp interface 5067 rdpserver 5067 netmask 255.255.255.255
static (inside,outside) tcp interface 5066 rdpserver 5066 netmask 255.255.255.255
access-group outside_access_in in interface outside
!
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
!
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
http 192.168.1.0 255.255.255.0 inside
!
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
!
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
!
!
telnet 10.0.0.0 255.255.255.0 inside
telnet timeout 50
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 50
console timeout 0
!
!
priority-queue outside
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp authenticate
ntp server 72.18.205.156 source outside prefer
!
!
xxx.xxx.xxx.xxx CONTENT REMOVED
!
!
class-map Sharepoint
class-map inspection_default
match default-inspection-traffic
class-map ef_traffic
match dscp ef
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
policy-map outbound-qos
class Sharepoint
priority
class class-default
police input 1400000
!
service-policy global_policy global
prompt hostname context
!END