Solved

Cisco ASA 5510 - Open port 5223

Posted on 2013-05-21
14
582 Views
Last Modified: 2013-06-12
We are working with a vendor and have installed a program that needs to be able to talk to their server and have the server talk back. To do this, I need to open port 5223 on our firewall and allow the vendors IP access on 5223 to an entire subnet 10.1.20.0/24.

I created an access rule in the ASA (from the GUI as that's what I am familair with) with the Source of the Vendors IP on the Outside Interface and a destination of the 10.1.20.0/24 network and a service of TCP 5223. I must either have this wrong or be missing something because it is not working. If I run the packet tracer it says the packet is dropped. Any help?
0
Comment
Question by:KLitman01
  • 5
  • 5
  • 4
14 Comments
 
LVL 24

Expert Comment

by:smckeown777
ID: 39185537
Destination needs to be ANY on the ACL...not 10.1.20.0/24

Then you setup a NAT rule to forward the 5223 to your internal host server...
0
 
LVL 2

Author Comment

by:KLitman01
ID: 39185559
Fixed the ACL but for the NAT would I create a Static NAT with the Source of my inside host and the translated the vendor server IP on the outside interface?
0
 
LVL 24

Accepted Solution

by:
smckeown777 earned 500 total points
ID: 39185570
Generally I create nat like this(note this is 8.2 code - not sure what version you are on)

static (inside,outside) tcp interface 5223 192.168.1.3 5223 netmask 255.255.255.255

Where 192.168.1.3 is my inside host...that works for me on port 5223 with my acl setup like I said before...
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 39187130
You would also need to configure an access list on outside interface to permit traffic from outside to inside host

If you could post your config, it would be more helpful
0
 
LVL 2

Author Comment

by:KLitman01
ID: 39187191
This is what I have:

ACL
access-list Outside-ISP1_access_in extended permit tcp host RemoteServerIP any 5223

NAT
static (Inside,Outside-ISP1) tcp interface 5223 10.1.12.55 5223 netmask 255.255.255.255

10.1.12.55 is the inside address the remote server needs to communicate with on 5223
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 39187199
Silly question - did you apply this access list to your outside interface?
0
 
LVL 24

Expert Comment

by:smckeown777
ID: 39187200
I assume that isn't working then?
What version have you?

sh run - run this command on the asa, at the top of the output it will show 8.2/8.4 or something...
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 18

Expert Comment

by:fgasimzade
ID: 39187204
You can also try packet tracer to see which stage is blocking connection

packet-tracer input outside tcp ipaddress_remote_host 5223 10.1.12.55 5223
0
 
LVL 2

Author Comment

by:KLitman01
ID: 39187221
We are running 8.2. Yes, it's applied to the outside interface.

Attached is the result of the Packet Tracer.
PacketTracker.JPG
0
 
LVL 24

Expert Comment

by:smckeown777
ID: 39187271
Have you that ACL entry typed correctly?

access-list Outside-ISP1_access_in extended permit tcp host RemoteServerIP any 5223

Should be
access-list Outside-ISP1_access_in extended permit tcp host RemoteServerIP any eq 5223

Check your config, maybe its a typo but only thing i see that might be wrong(course if its accepted the command like that I'm not sure)
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 39187293
Can you post your config then pls
0
 
LVL 2

Author Comment

by:KLitman01
ID: 39187297
Sorry, I have an object defined for the server and the port. Below is the actual command that was entered.

access-list Outside-ISP1_access_in extended permit tcp host Geotrax_Jabber any object-group jabber_ssl

I cannot post the config, sorry.
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 39187366
Well, everything looks fine here

If you post your sanitized config, we will get the whole picture. Do you want us to help you?
0
 
LVL 2

Author Comment

by:KLitman01
ID: 39187427
Let me see what I can do about the config.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now