topic Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager in Network Security

unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

jeba1521 — Fri, 21 Feb 2020 14:38:31 GMT

I am trying to portforward 80 and 443 to host a website . ASA 5506-X is used as firewall . I was able to configure in ASDM in previous versions, but unable to do the same in the new 6.2.2 FTD image. The traffic doesnt seem to flow . Have created static NAT from outside to inside interface with outside interface ip as source and server ip from internal networrk as destination with http-8080 port. Can someone suggest what is wrong with my configuration?

(www.piems4u.com, an personal income expense Management system)

Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

Flavio Miranda — Fri, 03 Nov 2017 20:24:59 GMT

Hello @jeba1521

Original Packet should come with Any IP address and Any port as source.

Destination address Outside-interface and Destination port 80.

Translated Packet should be Management as source address and Source port as 80.

Destination address the Web server and destination port 8080.

-If I helped you somehow, please, rate it as useful.-

Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

Marius Gunnerud — Sat, 04 Nov 2017 23:17:24 GMT

First off I would suggest doing static NAT with the source being inside and destination outside. Not that what you are doing wont work, it will, just easier to read and a better practice.

have you created an ACP entry for the NAT rule? Could you post the configuration?

Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

jeba1521 — Sun, 05 Nov 2017 10:57:17 GMT

Hi Marius Gunnerud
As the request comes from the ouside world, I have set from outside to inside. Also I have attached the ACL that I have created, for both the direction..

Thanks and Regards

Jeba J

Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

jeba1521 — Sun, 05 Nov 2017 11:12:37 GMT

Hi Flavio Miranda,
This is a test server and the url for request will be http://www.piems4u.com:8080/mfa/faces/index.xhtml. Hence port translation from 80 to 8080 is not required. I have recreated it as automatic static NAT and I have attached the screen shot.still its not working.
In older ASDM, the reverse NAT was automatically created. But in new FTD image, as it was not created, I have created one as well. Still its not working.

Thanks and Regards

Jeba J

Re: unable to portforward 80 from outside to inside using NAT in 5506-X FTD 6.2.2 using manager

Marius Gunnerud — Sun, 05 Nov 2017 11:33:22 GMT

Your ACL is not correct. You are specifying that the source port should also be tcp/8080. source port is almost always a random high number unless it is manually manipulated by the source user. So your ACL should look like this:

outside_zone Any Any Inside_zone Management_S... http-8080 Any Any Any

This is assuming that the server on the inside is listening on port tcp/8080 as it suggests in your NAT statement. If the server is listening on port tcp/80 and you want to access it using port tcp/8080 then you need to change both NAT and ACL.