Solved

Cisco ASA5505 port forwarding

Posted on 2013-05-12
6
682 Views
Last Modified: 2013-05-14
I'm having an issue getting my ASA5505 port forwarding working correctly.

Here's the setup:
1. I have 3 servers inside my network used for various functions but 1 main one that hosts exchange, BES, etc. This one has been configured and is working correctly with port forwarding with smtp, http, https, bes, etc

2. I now want to get a 2nd server with port forwarding working using port 8090 but so far all attempts have failed.

If I change the access rules port 8090 to the "company-sbs01" server in the ASA it works, but if I point port 8090 to "company-dvr01" it fails. I've setup (what I think) are correct NAT rules and the correct access rules.

Based on my testing I'm guessing it's a problem with my NAT rules but I don't know why.

Any suggestions?


hostname asa5505
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name company.local
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network company-sbs01
 host 192.168.1.5
 description company-SBS01
object network q-see_dvr
 host 192.168.1.7
object network chubb_security
 host 192.168.1.16
object network company-rp02
 host 192.168.1.8
 description company-rp02
object network company-dvr01
 host 192.168.1.10
 description company-dvr01
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list inside_access_in remark BlackBerry server access out
access-list inside_access_in extended permit tcp object company-sbs01 any eq 3101
access-list inside_access_in remark Permit inside accesss out
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any object company-sbs01 eq 3389
access-list outside_access_in remark SMTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq smtp
access-list outside_access_in remark Web access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq www
access-list outside_access_in remark HTTPS access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq https
access-list outside_access_in extended permit tcp any object company-sbs01 eq 987
access-list outside_access_in remark SecureView Pro access to company-DVR01
access-list outside_access_in extended permit tcp any object company-dvr01 eq 8090
access-list outside_access_in remark FTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp
access-list outside_access_in remark FTP Data access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp-data
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo outside
icmp permit any echo-reply outside
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
object network company-sbs01
 nat (inside,outside) static interface
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 10
dhcp-client client-id interface outside
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 192.168.1.5 source inside prefer
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns present_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns present_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
smtp-server 192.168.1.5
prompt hostname context
hpm topN enable

Open in new window

0
Comment
Question by:Phoenix_137
  • 2
  • 2
  • 2
6 Comments
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160276
I know this is a stupid question but do you have the ports open on the server that you are forwarding them to? Do you have Windows Firewall enabled?

If you have setup the port forwarding the same the only thing that would be in the way is Windows Firewall.
0
 

Author Comment

by:Phoenix_137
ID: 39160315
Yes, firewall is turned off.
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160370
Are you trying to use dvr01 and sbs01 as FTP servers and use non-standard ports for dvr01 and use the standard ports for sbs01.

The way the rules are setup in the code you provided would lead to that conclusion.

What testing are you using to see if you are able to connect to dvr01 over port 8090?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 17

Accepted Solution

by:
MAG03 earned 500 total points
ID: 39160964
I am assuming you are running ASA version 8.3 or higher:

The issue is with the first static NAT statement:
object network company-sbs01
 nat (inside,outside) static interface


This NATs all traffic and ports that arrive with the destination address of the outside interface to company-sbs0. there fore your second statement which is attempting to NAT/PAT 8090 will never work.

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090


You will need to make the NAT/PAT statement for sbs01 more specific to include ports 25, 80, 443 etc.  Now you will no longer be translating all ports to sbs01 and dvr01 should start working.
0
 

Author Comment

by:Phoenix_137
ID: 39163533
Thanks MAG03, that would definitely appear to be the problem. I've tried adding

nat (inside,outside) static interface service tcp 25 25
nat (inside,outside) static interface service tcp 80 80


under the object network caompnay-sbs01 to be more specific but it only allows one entry, and the 2nd entry will overwrite the first.

Is there a way to have the following (logical) code work?

object network company-sbs01
 nat (inside,outside) static interface interface service tcp 25 25
 nat (inside,outside) static interface interface service tcp 80 80
 nat (inside,outside) static interface interface service tcp 443 443
 nat (inside,outside) static interface interface service tcp 987 987
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
0
 
LVL 17

Assisted Solution

by:MAG03
MAG03 earned 500 total points
ID: 39163796
Unfortunately you will need a separate group name for each nat statement.  For example:

object network company-sbs01-smtp
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 25 25

object network company-sbs01-http
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 80 80

object network company-sbs01-https
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 443 443

object network company-sbs01-987
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 987 987

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090

This does increase the configuration a bit but on the plus side it does make managing the NAT rules easier and troubleshooting becomes easier too.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.
I designed this idea while studying technology in the classroom.  This is a semester long project.  Students are asked to take photographs on a specific topic which they find meaningful, it can be a place or situation such as travel or homelessness.…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now