topic Re: Port forwarding to my Cisco FPR 1010 using FDM in Network Security

Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Wed, 31 May 2023 12:08:22 GMT

Hi,

I need help please. I'm looking to create a port forwarding on my firewall.

I am trying to come from the outside through UDP port to the inside to my network.

Can someone guide me please how to create the Nat rule.

Thanks Ammar

Re: Port forwarding to my Cisco FPR 1010 using FDM

Rob Ingram — Wed, 31 May 2023 12:14:25 GMT

@AmmarHermiz14196 create a manual static NAT,

The example below will NAT the webserver "SERVER01" behind the outside interface IP address for HTTPS.

Example here in the section "inbound access" https://integratingit.wordpress.com/2020/02/08/ftd-configuration-using-fdm/

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Wed, 31 May 2023 12:18:24 GMT

Configure Cisco FTD Port Forwarding (via FDM) | PeteNetLive

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Thu, 01 Jun 2023 11:49:23 GMT

Hi Rob.

My situation is I want to come from the outside to my all inside subnets through specific IP address and specific port number. it's sort of VPN connection trying to do. But the instructions said the opposite or I am seeing wrong.

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Thu, 01 Jun 2023 11:50:56 GMT

Hi MHM,

I would have same response to you the instructions seem the opposite what I am trying to do. Thanks

Re: Port forwarding to my Cisco FPR 1010 using FDM

Rob Ingram — Thu, 01 Jun 2023 11:53:34 GMT

@AmmarHermiz14196 the NAT rules are bi-directional. In the the example, allows inbound access from the outside to a host on the inside.

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Thu, 01 Jun 2023 11:58:21 GMT

Thanks! Ammar

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Thu, 01 Jun 2023 12:50:53 GMT

the NAT for specific port is two way,
traffic form INside will NATing to OUTside (same port differ IP)
traffic from OUTside will NATing to INside (same port differ IP)

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Sat, 03 Jun 2023 01:58:55 GMT

Hi,

It is not working obviously I am doing it wrong. what I am trying to do is. i have Raspberry Pi installed Pivpn on it. trying to figure out how to set up Cisco FRP 1010.

so what I did. I set up one of the port on firewall statically with DHCP pool. also I created port it is must from WireGurad . my nat looks like below. so what I am doing wrong or what I need to do. please help. I appreciate your help.

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Sun, 04 Jun 2023 08:00:15 GMT

you use NAT for U-Turn anyconnect traffic ?

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Sun, 04 Jun 2023 15:30:53 GMT

Don't have Anyconnect.

My network setup :

Dynamic IP coming in to the Router (Verizon) DHCP going out to the Firewall. Firewall connected through DHCP not Static from the firewall I have 6 networks all trunk to two switches. I have Vlans setup between all those networks. Everything working the way I want it.

I have one port left on the firewall unuse.

I have Raspberry Pi hooked up to the Verizon router working as Pi-Hole and of course its my DNS.

I have another Raspberry Pi want to install PiVPN on it.

So now the questions are:

- Where I plug the Ras.Pi the one I want to install PiVPN to router or the empty port on the FW?

- I have to open a specific UDP port for Port forwarding, So I should open it on the router or the FW?

- Do I need to create a network object or a host on the FW?

- How is the NAT and Access list should looks like?

To be honest to setup PiVPN is very easy but what makes it difficult at least in my world is the Cisco Firewall.

As always Thank you very much for you help and time.

Ammar

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Sun, 04 Jun 2023 15:59:41 GMT

So to confirm,
you have Ri-VPN (S2S VPN not remote access VPN), and you want to bypass this VPN traffic through the FPR, we need NATing the private IP behind the FPR to public IP (OUTSIDE)?
am I right ?

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Sun, 04 Jun 2023 16:19:16 GMT

Yes. You are right.

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Sun, 04 Jun 2023 18:01:43 GMT

You have free public IP
then you need Static NAT 1:1

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Sun, 04 Jun 2023 17:45:02 GMT

So if I understood correctly.

Create network object for the inside 192.168.75.x/24 ?

Plug the RasPi into the FRP? and make the interface type static and give it an IP 192.168.77.x/24 ?

I don't have DMZ. it is my home network.

Thank you.

Ammar

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Mon, 05 Jun 2023 01:47:51 GMT

Hi MHM,

This is the last time I won't bother you! below is what I did.

Please let me know if it is looks okay.

Thank you very much for effort

NAT

Access list

Re: Port forwarding to my Cisco FPR 1010 using FDM

Rob Ingram — Mon, 05 Jun 2023 06:34:03 GMT

@AmmarHermiz14196 if you wish to permit inbound traffic to your PiVPN, then that Access Control Rule is incorrect.

You need to write the rule from outside to inside and use the real IP address for the destination server.

Src Zone: outside_zone
Src Net: any
Dst Zone: connection-to-ras-pi
Dst Net: <REAL IP ADDRESS OF RASPBERRY PI>
Dst Ports: ????

You should also define the only the required ports in the Dst Ports (seeing as you are translating all ports in the NAT rule).

The example guide previously provided in the initial response demonstrates how to create the NAT rule for inbound access from the internet and the Access Control rule, just amend to fit your requirements.

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Mon, 05 Jun 2023 06:35:51 GMT

also additional to @Rob Ingram mention about the ACL, what is IP 192.168.75.201/29 you use as INterface ?

Re: Port forwarding to my Cisco FPR 1010 using FDM

AmmarHermiz14196 — Mon, 05 Jun 2023 09:51:02 GMT

Good morning @Rob Ingram, @MHM Cisco World I would start with thanking you guys!!!

The IP 192.168.75.201/29 is IP created for the interface on FRP for the Ras-Pi where is going to be connected. so the Ras-Pi would have an IP of 192.168.75.201/29.

So the Dst Zone: connection-to-ras-pi would have the above IP 192.168.75.201/29

@Rob Ingram

Src Zone: outside_zone
Src Net: any
Dst Zone: connection-to-ras-pi 192.168.75.201/29 Do I need to create DHCP server for that IP address ???
Dst Net: <REAL IP ADDRESS OF RASPBERRY PI> 192.168.75.201/29
Dst Ports: Pi-VPN use port UDP 51820

What about the NAT rule is it correct??

Thanks,

Ammar

Re: Port forwarding to my Cisco FPR 1010 using FDM

MHM Cisco World — Mon, 05 Jun 2023 10:01:22 GMT

what @Rob Ingram mention here you need ACL from traffic from Ras-Pi to OUTside and one other from OUTside to Ras-Pi