Solved

Cisco ASA5505 port forwarding

Posted on 2013-05-12
6
681 Views
Last Modified: 2013-05-14
I'm having an issue getting my ASA5505 port forwarding working correctly.

Here's the setup:
1. I have 3 servers inside my network used for various functions but 1 main one that hosts exchange, BES, etc. This one has been configured and is working correctly with port forwarding with smtp, http, https, bes, etc

2. I now want to get a 2nd server with port forwarding working using port 8090 but so far all attempts have failed.

If I change the access rules port 8090 to the "company-sbs01" server in the ASA it works, but if I point port 8090 to "company-dvr01" it fails. I've setup (what I think) are correct NAT rules and the correct access rules.

Based on my testing I'm guessing it's a problem with my NAT rules but I don't know why.

Any suggestions?


hostname asa5505
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name company.local
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network company-sbs01
 host 192.168.1.5
 description company-SBS01
object network q-see_dvr
 host 192.168.1.7
object network chubb_security
 host 192.168.1.16
object network company-rp02
 host 192.168.1.8
 description company-rp02
object network company-dvr01
 host 192.168.1.10
 description company-dvr01
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list inside_access_in remark BlackBerry server access out
access-list inside_access_in extended permit tcp object company-sbs01 any eq 3101
access-list inside_access_in remark Permit inside accesss out
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any object company-sbs01 eq 3389
access-list outside_access_in remark SMTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq smtp
access-list outside_access_in remark Web access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq www
access-list outside_access_in remark HTTPS access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq https
access-list outside_access_in extended permit tcp any object company-sbs01 eq 987
access-list outside_access_in remark SecureView Pro access to company-DVR01
access-list outside_access_in extended permit tcp any object company-dvr01 eq 8090
access-list outside_access_in remark FTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp
access-list outside_access_in remark FTP Data access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp-data
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo outside
icmp permit any echo-reply outside
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
object network company-sbs01
 nat (inside,outside) static interface
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 10
dhcp-client client-id interface outside
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 192.168.1.5 source inside prefer
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns present_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns present_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
smtp-server 192.168.1.5
prompt hostname context
hpm topN enable

Open in new window

0
Comment
Question by:Phoenix_137
  • 2
  • 2
  • 2
6 Comments
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160276
I know this is a stupid question but do you have the ports open on the server that you are forwarding them to? Do you have Windows Firewall enabled?

If you have setup the port forwarding the same the only thing that would be in the way is Windows Firewall.
0
 

Author Comment

by:Phoenix_137
ID: 39160315
Yes, firewall is turned off.
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160370
Are you trying to use dvr01 and sbs01 as FTP servers and use non-standard ports for dvr01 and use the standard ports for sbs01.

The way the rules are setup in the code you provided would lead to that conclusion.

What testing are you using to see if you are able to connect to dvr01 over port 8090?
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 17

Accepted Solution

by:
MAG03 earned 500 total points
ID: 39160964
I am assuming you are running ASA version 8.3 or higher:

The issue is with the first static NAT statement:
object network company-sbs01
 nat (inside,outside) static interface


This NATs all traffic and ports that arrive with the destination address of the outside interface to company-sbs0. there fore your second statement which is attempting to NAT/PAT 8090 will never work.

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090


You will need to make the NAT/PAT statement for sbs01 more specific to include ports 25, 80, 443 etc.  Now you will no longer be translating all ports to sbs01 and dvr01 should start working.
0
 

Author Comment

by:Phoenix_137
ID: 39163533
Thanks MAG03, that would definitely appear to be the problem. I've tried adding

nat (inside,outside) static interface service tcp 25 25
nat (inside,outside) static interface service tcp 80 80


under the object network caompnay-sbs01 to be more specific but it only allows one entry, and the 2nd entry will overwrite the first.

Is there a way to have the following (logical) code work?

object network company-sbs01
 nat (inside,outside) static interface interface service tcp 25 25
 nat (inside,outside) static interface interface service tcp 80 80
 nat (inside,outside) static interface interface service tcp 443 443
 nat (inside,outside) static interface interface service tcp 987 987
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
0
 
LVL 17

Assisted Solution

by:MAG03
MAG03 earned 500 total points
ID: 39163796
Unfortunately you will need a separate group name for each nat statement.  For example:

object network company-sbs01-smtp
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 25 25

object network company-sbs01-http
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 80 80

object network company-sbs01-https
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 443 443

object network company-sbs01-987
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 987 987

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090

This does increase the configuration a bit but on the plus side it does make managing the NAT rules easier and troubleshooting becomes easier too.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now