Solved

Cisco ASA5505 port forwarding

Posted on 2013-05-12
6
691 Views
Last Modified: 2013-05-14
I'm having an issue getting my ASA5505 port forwarding working correctly.

Here's the setup:
1. I have 3 servers inside my network used for various functions but 1 main one that hosts exchange, BES, etc. This one has been configured and is working correctly with port forwarding with smtp, http, https, bes, etc

2. I now want to get a 2nd server with port forwarding working using port 8090 but so far all attempts have failed.

If I change the access rules port 8090 to the "company-sbs01" server in the ASA it works, but if I point port 8090 to "company-dvr01" it fails. I've setup (what I think) are correct NAT rules and the correct access rules.

Based on my testing I'm guessing it's a problem with my NAT rules but I don't know why.

Any suggestions?


hostname asa5505
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name company.local
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network company-sbs01
 host 192.168.1.5
 description company-SBS01
object network q-see_dvr
 host 192.168.1.7
object network chubb_security
 host 192.168.1.16
object network company-rp02
 host 192.168.1.8
 description company-rp02
object network company-dvr01
 host 192.168.1.10
 description company-dvr01
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list inside_access_in remark BlackBerry server access out
access-list inside_access_in extended permit tcp object company-sbs01 any eq 3101
access-list inside_access_in remark Permit inside accesss out
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any object company-sbs01 eq 3389
access-list outside_access_in remark SMTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq smtp
access-list outside_access_in remark Web access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq www
access-list outside_access_in remark HTTPS access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq https
access-list outside_access_in extended permit tcp any object company-sbs01 eq 987
access-list outside_access_in remark SecureView Pro access to company-DVR01
access-list outside_access_in extended permit tcp any object company-dvr01 eq 8090
access-list outside_access_in remark FTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp
access-list outside_access_in remark FTP Data access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp-data
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo outside
icmp permit any echo-reply outside
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
object network company-sbs01
 nat (inside,outside) static interface
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 10
dhcp-client client-id interface outside
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 192.168.1.5 source inside prefer
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns present_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns present_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
smtp-server 192.168.1.5
prompt hostname context
hpm topN enable

Open in new window

0
Comment
Question by:Phoenix_137
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
6 Comments
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160276
I know this is a stupid question but do you have the ports open on the server that you are forwarding them to? Do you have Windows Firewall enabled?

If you have setup the port forwarding the same the only thing that would be in the way is Windows Firewall.
0
 

Author Comment

by:Phoenix_137
ID: 39160315
Yes, firewall is turned off.
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39160370
Are you trying to use dvr01 and sbs01 as FTP servers and use non-standard ports for dvr01 and use the standard ports for sbs01.

The way the rules are setup in the code you provided would lead to that conclusion.

What testing are you using to see if you are able to connect to dvr01 over port 8090?
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 17

Accepted Solution

by:
MAG03 earned 500 total points
ID: 39160964
I am assuming you are running ASA version 8.3 or higher:

The issue is with the first static NAT statement:
object network company-sbs01
 nat (inside,outside) static interface


This NATs all traffic and ports that arrive with the destination address of the outside interface to company-sbs0. there fore your second statement which is attempting to NAT/PAT 8090 will never work.

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090


You will need to make the NAT/PAT statement for sbs01 more specific to include ports 25, 80, 443 etc.  Now you will no longer be translating all ports to sbs01 and dvr01 should start working.
0
 

Author Comment

by:Phoenix_137
ID: 39163533
Thanks MAG03, that would definitely appear to be the problem. I've tried adding

nat (inside,outside) static interface service tcp 25 25
nat (inside,outside) static interface service tcp 80 80


under the object network caompnay-sbs01 to be more specific but it only allows one entry, and the 2nd entry will overwrite the first.

Is there a way to have the following (logical) code work?

object network company-sbs01
 nat (inside,outside) static interface interface service tcp 25 25
 nat (inside,outside) static interface interface service tcp 80 80
 nat (inside,outside) static interface interface service tcp 443 443
 nat (inside,outside) static interface interface service tcp 987 987
object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090
0
 
LVL 17

Assisted Solution

by:MAG03
MAG03 earned 500 total points
ID: 39163796
Unfortunately you will need a separate group name for each nat statement.  For example:

object network company-sbs01-smtp
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 25 25

object network company-sbs01-http
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 80 80

object network company-sbs01-https
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 443 443

object network company-sbs01-987
 host 192.168.1.5
 nat (inside,outside) static interface service tcp 987 987

object network company-dvr01
 nat (inside,outside) static interface service tcp 8090 8090

This does increase the configuration a bit but on the plus side it does make managing the NAT rules easier and troubleshooting becomes easier too.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question