topic Re: ASA port forwarding not working. Help ? in Network Security

ASA port forwarding not working. Help ?

Diogene — Thu, 04 Mar 2021 13:48:18 GMT

Hello everybody. Could someone help me with this running-config. I would like to do port-forwarding with my AS5506W. My private server is on 10.10.30.2.

Find below my running-config on ASA. I have done all that is the running-config but it is still not working. I know I have some repeated NAT and ACL. Can you tell me what is wrong ?

Re: ASA port forwarding not working. Help ?

balaji.bandi — Thu, 04 Mar 2021 14:23:49 GMT

Your intention to port-forward only specific ports or any ? ( your config required lot of cleanup, why there is BVI Interface ? and inside_X interfaces)

here is the syntax you have - add host should work,

object network NAS-TEST

host 10.10.30.2
nat (INT-NAS,outside) static interface service tcp 4480 4480

if not post

#show run access-group

Re: ASA port forwarding not working. Help ?

Diogene — Thu, 04 Mar 2021 14:40:34 GMT

Only in specific port : 4480.

Re: ASA port forwarding not working. Help ?

balaji.bandi — Thu, 04 Mar 2021 15:54:24 GMT

above should work, try and advise

if not working post packet trace output.

Re: ASA port forwarding not working. Help ?

Sheraz.Salim — Thu, 04 Mar 2021 17:13:21 GMT

!
object network NAS-TEST
 host 10.10.30.2
 nat (INT-NAS,outside) static interface
!
access-list OUTSIDE_IN extended permit tcp any object NAS-TEST eq 4480
access-group OUTSIDE_IN in interface outside
!

basically, you missing the access-list from outsider interface. do a packet tracer it will work now.

Re: ASA port forwarding not working. Help ?

MHM Cisco World — Thu, 04 Mar 2021 17:44:58 GMT

object network NAS-TEST<- delete this

nat (INT-NAS,outside) static interface service tcp 4480 4480

nat (INT-NAS,outside) static IP service tcp 4480 4480<- add this

please make change as above.

Re: ASA port forwarding not working. Help ?

Diogene — Thu, 04 Mar 2021 18:19:46 GMT

OK. I have this in my configuration :

access-list outside_access_in extended permit ip any any 
access-group outside_access_in in interface outside

It's not enouth as permission ?

Re: ASA port forwarding not working. Help ?

Sheraz.Salim — Thu, 04 Mar 2021 18:39:34 GMT

access-list outside_access_in extended permit ip any any 
access-group outside_access_in in interface outside

do not use "permit ip any any" at outside as your network will be at secuirty risk.

no access-list outside_access_in permit ip any any

access-list outside_access_in extended permit tcp any host 10.10.30.2

access-group outside_access_in in interface outside

Re: ASA port forwarding not working. Help ?

Diogene — Thu, 04 Mar 2021 20:18:56 GMT

I followed this tutorial for ASDM : https://www.youtube.com/watch?v=cKnAiiUgsgg

It works well.

In running-configuration :

object network NAS-host
 host 10.10.50.2
object service NAS-service
 service tcp source eq 4480
nat (INT-WIFI-PERSONNEL,outside) source static NAS-host interface service any NAS-service
access-list outside_access_in extended permit tcp any object NAS-host eq 4480
access-group outside_access_in in interface outside

Thank you very much for your help.

Regards,