Phoenix_137
asked on
Cisco ASA5505 port forwarding
I'm having an issue getting my ASA5505 port forwarding working correctly.
Here's the setup:
1. I have 3 servers inside my network used for various functions but 1 main one that hosts exchange, BES, etc. This one has been configured and is working correctly with port forwarding with smtp, http, https, bes, etc
2. I now want to get a 2nd server with port forwarding working using port 8090 but so far all attempts have failed.
If I change the access rules port 8090 to the "company-sbs01" server in the ASA it works, but if I point port 8090 to "company-dvr01" it fails. I've setup (what I think) are correct NAT rules and the correct access rules.
Based on my testing I'm guessing it's a problem with my NAT rules but I don't know why.
Any suggestions?
Here's the setup:
1. I have 3 servers inside my network used for various functions but 1 main one that hosts exchange, BES, etc. This one has been configured and is working correctly with port forwarding with smtp, http, https, bes, etc
2. I now want to get a 2nd server with port forwarding working using port 8090 but so far all attempts have failed.
If I change the access rules port 8090 to the "company-sbs01" server in the ASA it works, but if I point port 8090 to "company-dvr01" it fails. I've setup (what I think) are correct NAT rules and the correct access rules.
Based on my testing I'm guessing it's a problem with my NAT rules but I don't know why.
Any suggestions?
hostname asa5505
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
domain-name company.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network company-sbs01
host 192.168.1.5
description company-SBS01
object network q-see_dvr
host 192.168.1.7
object network chubb_security
host 192.168.1.16
object network company-rp02
host 192.168.1.8
description company-rp02
object network company-dvr01
host 192.168.1.10
description company-dvr01
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list inside_access_in remark BlackBerry server access out
access-list inside_access_in extended permit tcp object company-sbs01 any eq 3101
access-list inside_access_in remark Permit inside accesss out
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any object company-sbs01 eq 3389
access-list outside_access_in remark SMTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq smtp
access-list outside_access_in remark Web access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq www
access-list outside_access_in remark HTTPS access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq https
access-list outside_access_in extended permit tcp any object company-sbs01 eq 987
access-list outside_access_in remark SecureView Pro access to company-DVR01
access-list outside_access_in extended permit tcp any object company-dvr01 eq 8090
access-list outside_access_in remark FTP access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp
access-list outside_access_in remark FTP Data access to company-SBS01
access-list outside_access_in extended permit tcp any object company-sbs01 eq ftp-data
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo outside
icmp permit any echo-reply outside
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
object network company-sbs01
nat (inside,outside) static interface
object network company-dvr01
nat (inside,outside) static interface service tcp 8090 8090
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 10
dhcp-client client-id interface outside
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 192.168.1.5 source inside prefer
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns present_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns present_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
smtp-server 192.168.1.5
prompt hostname context
hpm topN enable
ASKER
Yes, firewall is turned off.
Are you trying to use dvr01 and sbs01 as FTP servers and use non-standard ports for dvr01 and use the standard ports for sbs01.
The way the rules are setup in the code you provided would lead to that conclusion.
What testing are you using to see if you are able to connect to dvr01 over port 8090?
The way the rules are setup in the code you provided would lead to that conclusion.
What testing are you using to see if you are able to connect to dvr01 over port 8090?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks MAG03, that would definitely appear to be the problem. I've tried adding
nat (inside,outside) static interface service tcp 25 25
nat (inside,outside) static interface service tcp 80 80
under the object network caompnay-sbs01 to be more specific but it only allows one entry, and the 2nd entry will overwrite the first.
Is there a way to have the following (logical) code work?
object network company-sbs01
nat (inside,outside) static interface interface service tcp 25 25
nat (inside,outside) static interface interface service tcp 80 80
nat (inside,outside) static interface interface service tcp 443 443
nat (inside,outside) static interface interface service tcp 987 987
object network company-dvr01
nat (inside,outside) static interface service tcp 8090 8090
nat (inside,outside) static interface service tcp 25 25
nat (inside,outside) static interface service tcp 80 80
under the object network caompnay-sbs01 to be more specific but it only allows one entry, and the 2nd entry will overwrite the first.
Is there a way to have the following (logical) code work?
object network company-sbs01
nat (inside,outside) static interface interface service tcp 25 25
nat (inside,outside) static interface interface service tcp 80 80
nat (inside,outside) static interface interface service tcp 443 443
nat (inside,outside) static interface interface service tcp 987 987
object network company-dvr01
nat (inside,outside) static interface service tcp 8090 8090
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If you have setup the port forwarding the same the only thing that would be in the way is Windows Firewall.