Solved

cisco firewall asdm  - need to allow a port on an IP address

Posted on 2015-02-02
6
340 Views
Last Modified: 2015-02-04
Hi there.
I'm using the asdm (version 5) of a Cisco ASA 5520 firewall.
I am trying to allow access from any external IP address to access a server on port 8172.
I already have a NAT rule to translate from external IP address (1.2.3.4) to internal (192.168.1.10) this works fine for accessing port 80 etc from the outside world.
What steps do I need to take as I have tried adding access rules to allow to this port but i still cant telnet there.
Also, do I need to do anything with port forwarding or is this not relevant for the above?
0
Comment
Question by:jamiegf
  • 3
  • 3
6 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 40584608
Kinda depends on whether you're performing Port Address Translation (translating individual ports) or Network Address Translation (translating the IP address, which includes all ports).

If your NAT rules specify port numbers, then you need to add a NAT rule for the new port in addition to editing the ACL.

If your NAT rules only specify IP addresses, then editing the ACL should be enough to allow the traffic.


And make sure that the port is actually active on the server, and is not blocked by a local firewall.  If it's a Windows box, run "netstat -ano | find ":<port>" to see if the server is listening on the correct port.  Then check the Windows firewall.
0
 

Author Comment

by:jamiegf
ID: 40586937
NAT rules only specify IP addresses.

I have tried adding security policies and also editing pre exisiting Service Groups to include my port number but i still cannot telnet to the port.
I have tested the other ports which work and do not work - these are behaving correctly.
I have also tried adding different protocols / ports but anything i add doesnt seem to come into effect .
0
 
LVL 28

Expert Comment

by:asavener
ID: 40587175
Did you check that the port is open on the server?
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 

Author Comment

by:jamiegf
ID: 40588172
Hi Asavener. Yes, i forgot to mention that. Windows firewall is turned off.
0
 
LVL 28

Accepted Solution

by:
asavener earned 500 total points
ID: 40588546
Can you successfully telnet to the port when you're inside the network?



Suggest the next step is to use the packet tracer feature in ASDM to simulate the traffic.  The ASA will test the traffic against all of its rules and tell you whether it will pass the traffic or deny it.
0
 

Author Closing Comment

by:jamiegf
ID: 40588811
"Can you successfully telnet to the port when you're inside the network?"
No - i couldnt, which told me the app is not working as it should.

I set up a website and gave it port 8172 to test my firewall rules; it works fine.

Thanks for your help Asavener :)
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASDM device NT domain question 4 45
access vs trunk with voice vlan 2 44
Palo Alto Networks: View Tunnel packet counts? 2 27
Cisco WAP POE power 28 79
We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question