topic Hello, in Network Security

ASA 5510 Port Forwarding Issue

limjohn23 — Tue, 12 Mar 2019 09:17:59 GMT

Please help,

For some reason I keep getting denied when configuring port forwarding on an ASA 5510. The current topology is Internet----Modem-----Router--------ASA 5510 (Active/Standby)---------Inside------PHP_TEST

If I am allowing to open a web server 192.168.2.5 to be accessed from OUTSIDE with the configuration below, I keep getting denied. Can you please advise what configuration needed. Thanks in advance.

object network PHP_TEST

host 192.168.2.5

nat (INSIDE,OUTSIDE) static interface service tcp 80 80

access-list OutsideToPHPServer permit tcp any host 192.168.2.5 eq www

access-group OutsideToPHPServer in interface OUTSIDE

---------------------------------------------------------------------------

Below is my configuration, which I omitted unnecessary config for this issue.

: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz

ASA Version 9.1(6)

hostname XXXXXXXXXXXXXXXX

domain-name XXXXXXXXXXXXXXXXXXXXXXX

enable password XXXXXXXXXXXXXXXXX encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd XXXXXXXXXXXXXXXX encrypted

names

dns-guard

ip local pool RVPN_User 10.0.0.1-10.0.0.10 mask 255.255.255.0

interface Ethernet0/0

description *** Connection to Router Plutus ***

nameif OUTSIDE

security-level 0

ip address 192.168.1.2 255.255.255.0 standby 192.168.1.10

interface Ethernet0/1

description *** Connection to DMZ Zone ***

nameif DMZ

security-level 55

ip address 192.168.3.1 255.255.255.0 standby 192.168.3.10

interface Ethernet0/2

description *** Connection to LAN ***

nameif INSIDE

security-level 55

ip address 192.168.2.1 255.255.255.0 standby 192.168.2.10

interface Ethernet0/3

description *** Available Link ***

shutdown

nameif DMZ2

security-level 55

ip address 192.168.5.1 255.255.255.0

interface Management0/0

description LAN Failover Interface

management-only

boot system disk0:/asa916-k8.bin

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns domain-lookup OUTSIDE

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-namexxxxxxxxxxxxxxxxxxxxxxxxxx

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network PHP_TEST

host 192.168.2.5

object network dmz-subnet

subnet 192.168.3.0 255.255.255.0

object network inside-subnet

subnet 192.168.2.0 255.255.255.0

object network Outside_Network

subnet 192.168.1.0 255.255.255.0

object network NETWORK_OBJ_10.0.0.0_28

subnet 10.0.0.0 255.255.255.240

object service HTTP

service tcp source eq www

object-group service DM_INLINE_SERVICE_2

service-object tcp-udp destination eq www

service-object tcp destination eq www

service-object udp destination eq www

object-group network DMZ-subnet

network-object 192.168.3.0 255.255.255.0

object-group network opendns-servers

network-object host 208.67.220.220

network-object host 208.67.220.222

object-group network googledns-servers

network-object host 8.8.4.4

network-object host 8.8.8.8

object-group service DM_INLINE_SERVICE_1

service-object tcp destination eq www

service-object udp destination eq www

access-list OUTSIDE_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit ip any4 any4 log disable

access-list OUTSIDE_access_in_1 extended permit ip any any log disable

access-list outside_acl extended permit ip any4 192.168.3.0 255.255.255.0 log disable

access-list outside_acl extended permit ip any4 any4

access-list inbound extended permit ip any4 any4 log disable

access-list global_mpc extended permit ip any any

access-list inside_access_in extended permit ip any4 any4 log disable

access-list inside_access_out extended permit ip any4 any4

pager lines 24

logging enable

logging timestamp

logging trap informational

logging asdm informational

logging host INSIDE 192.168.2.12

no logging message 106015

no logging message 313001

no logging message 313008

no logging message 106023

no logging message 710003

no logging message 106100

no logging message 302015

no logging message 302014

no logging message 302013

no logging message 302018

no logging message 302017

no logging message 302016

no logging message 302021

no logging message 302020

flow-export destination INSIDE 192.168.2.12 2055

mtu OUTSIDE 1500

mtu DMZ 1500

mtu INSIDE 1500

mtu DMZ2 1500

ip verify reverse-path interface OUTSIDE

failover

failover lan unit primary

failover lan interface FAILOVER Management0/0

failover key *****

failover interface ip FAILOVER 172.16.254.254 255.255.255.0 standby 172.16.254.250

icmp unreachable rate-limit 1 burst-size 1

icmp permit any OUTSIDE

icmp permit any DMZ

icmp permit 192.168.3.0 255.255.255.0 DMZ

asdm image disk0:/asdm-771.bin

asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (INSIDE,OUTSIDE) source static PHP_TEST PHP_TEST service HTTP HTTP

object network dmz-subnet

nat (DMZ,OUTSIDE) dynamic interface

object network inside-subnet

nat (INSIDE,OUTSIDE) dynamic interface

access-group OUTSIDE_access_in_1 in interface OUTSIDE

access-group DMZ_access_in in interface DMZ

access-group inside_access_out out interface INSIDE

route OUTSIDE 0.0.0.0 0.0.0.0 192.168.1.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

no snmp-server location

no snmp-server contact

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des