Cisco ASA, Allowing an external IP through to specific device on network on certain ports.

Hi,

Just having a sense check here.

I am allowing an external company through our firewall for remote access to a device on our internal network on certain ports. I am locking down the access to only their external IP.

I have created the following network objects

Device_Ext (Public IP for the company to use for access)
Device_Int (Internal Lan IP of the destination device)
External_Company_IP
Device_TCP (Services groups)

object-group service Device_TCP tcp
 port-object eq 5222
 port-object eq 5269
 port-object eq 8444


access-list Outside_access_in extended permit tcp object External_Company_IP object Device_Int object-group Device_TCP

Question do I have to NAT the Device_Ext through to the Device_Int ??

Not sure if I need both access list and NAT.

Help appreciated.

Cheers
zander1Asked:
Who is Participating?
 
dusanm011Connect With a Mentor Commented:
Hello zander1,

first I am not aware which asa version you are using (I am ok with 8.4), but I can say what you have to do.

First you need "object network YourServer" for your server with "host Device_Int"
Next you (yes you do) nat for this device of yours like

object network YourServer
 nat (inside,Outside) static Public_IP_for_this_server

access-list Outside_access_in line 3 extended permit object-group Device_TCP Device_Ext  object YourServer

This syntax is for 8.4 ver.

It will do.

Regards.
0
 
Pete LongConnect With a Mentor Technical ConsultantCommented:
Agreed you are just doing a static translation.

Add a Static (One to One) NAT Translation to a Cisco ASA 5500 Firewall

Other than that you're good - unless you're pre version 8.3 then you allow traffic to the internal IP and your static would look like this

static (inside,outside) DEVICE_EXT DEVICE_INT netmask 255.255.255.255

Pete
0
 
zander1Author Commented:
Thank you
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.