topic Asa 5506 version 9.5 in Network Security

Asa 5506 version 9.5

patrickernane — Tue, 12 Mar 2019 08:54:11 GMT

Good afternoon, I have an ASA 5506 I'm having difficulty redirecting the public ip 200,188,213,171 ----> to get the IP address at 172.18.37.11:8080 that our Cameras nvr and get external access in the browser by typing;
Http://200.188.213.171:8080 Help?

Hello,

visco — Wed, 08 Feb 2017 16:46:40 GMT

Hello,

You will need a NAT for translation, example:

object network NVR-172.18.37.11
nat (inside,outside) static 200.188.213.171 service tcp 8080 8080

I tried this setting but it

patrickernane — Wed, 08 Feb 2017 16:58:51 GMT

I tried this setting but it gives me an error  

FW001(config-network-object)# nat (inside,outside) static 200.188.213.171 ser$
ERROR: empty object/object-group(s) detected. NAT Policy is not downloaded

Sorry, the network object

visco — Wed, 08 Feb 2017 17:12:06 GMT

Sorry, the network object will need to be created first:

object network NVR-172.18.37.11

host 172.18.37.11

Then add the NAT.

You may also need to add an entry on your ACL that is applied to the outside interface to allow the traffic in from the outside. Are you wanting to allow it from anywhere, or lock it down to a specific Public IP? Do you have an existing ACL applied to the outside interface?

run the command:

show run access-group

Is there an ACL applied to the outside interface?

Show

patrickernane — Wed, 08 Feb 2017 17:24:57 GMT

Show

FW001# conf t
FW001(config)# show ru
FW001(config)# show running-config obje
FW001(config)# show running-config object
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
FW001(config)# nat (inside,outside) static 200.188.213.171 service tcp 8080 8080
ERROR: empty object/object-group(s) detected. NAT Policy is not downloaded

I created the object but when I go to add nat it generates an error is not downloade

You do not have the access group

It looks like the network

visco — Wed, 08 Feb 2017 17:32:02 GMT

It looks like the network object is still not created, it says its empty. Do this first:

object network NVR-172.18.37.11
host 172.18.37.11

After that host entry is added in the network object, you can add the NAT

You experienced the same

patrickernane — Wed, 08 Feb 2017 17:41:02 GMT

You experienced the same error.

This is the start configuration show run of the wing



FW001# show run
FW001# show running-config
: Saved

:
: Serial Number: JAD193400NV
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cor es)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 nameif outside
 security-level 0
 ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
 management-only
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network NAT-LAN
 subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
 host 172.18.37.11
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NAT-LAN
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
 no active
 destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
 destination address email callhome@cisco.com
 destination transport-method http
 subscribe-to-alert-group diagnostic
 subscribe-to-alert-group environment
 subscribe-to-alert-group inventory periodic monthly
 subscribe-to-alert-group configuration periodic monthly
 subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:d98b97903fb93b1552e51cbaa39336b1
: end
FW001#

ERROR: NAT Policy is not

patrickernane — Wed, 08 Feb 2017 17:45:52 GMT

ERROR: NAT Policy is not downloaded

Also there is no in-use NAT entry for this IP...

fw-01(config)# sh nat 200.188.213.171 detail

No matching NAT policy found

Thanks for the config. See if

visco — Wed, 08 Feb 2017 17:48:26 GMT

Thanks for the config. See if the following works:

object network NVR-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080

Now there was no errorobject

patrickernane — Wed, 08 Feb 2017 17:55:44 GMT

Now there was no error

object network NAT-LAN
 nat (inside,outside) dynamic interface
object network NVR-172.18.37.11
 nat (inside,outside) static interface service tcp 8080 8080
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location



Your add the line

Access-list NVR1 allow tcp any host 172.18.37.11 eq 8080 8080

It will be possible to access from a browser http://200.188.213.171:8080

It tested but did not open

patrickernane — Wed, 08 Feb 2017 18:01:28 GMT

It tested but did not open login screen without browser

Access-list NVR1 allow tcp any host 172.18.37.11 eq 8080

n my internal network this ip 172.18.37.11:8080 is of the NVR and I want to access defora here in not typing in the browser http://200.188.213.171:8080

Have to apply your new NVR1

visco — Wed, 08 Feb 2017 18:04:29 GMT

Have to apply your new NVR1 ACL to access-group on outside interface now:

access-group NVR1 in interface outside

Sorry, I do not understand,

patrickernane — Wed, 08 Feb 2017 18:25:20 GMT

Sorry, I do not understand, can you add me an example please?

conf t

visco — Wed, 08 Feb 2017 18:33:22 GMT

conf t

access-group NVR1 in interface outside

Did this way but did not work

patrickernane — Wed, 08 Feb 2017 18:33:32 GMT

Did this way but did not work!

configure mode commands/options:
WORD Specify the name of an access-list
FW001(config-network-object)# ACCess-group NVR1 ?

configure mode commands/options:
global For traffic on all interfaces
in For input traffic
out For output traffic
<cr>
FW001(config-network-object)# ACCess-group NVR1 IN
FW001(config-network-object)# ACCess-group NVR1 IN ?

configure mode commands/options:
interface Keyword to specify an interface
FW001(config-network-object)# ACCess-group NVR1 IN interf
FW001(config-network-object)# ACCess-group NVR1 IN interface ?

configure mode commands/options:
Current available interface(s):
inside Name of interface GigabitEthernet1/1
outside Name of interface GigabitEthernet1/8
FW001(config-network-object)# ACCess-group NVR1 IN interface OUTSIDE
FW001(config)#

Ah I added this line but it

patrickernane — Wed, 08 Feb 2017 18:43:43 GMT

Ah I added this line but it did not work

Can you post the new config

visco — Wed, 08 Feb 2017 18:43:46 GMT

Can you post the new config

show runFW001(config)# show

patrickernane — Wed, 08 Feb 2017 18:49:09 GMT

show run
FW001(config)# show running-config
: Saved

:
: Serial Number: JAD193400NV
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cor es)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif outside
security-level 0
ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
host 172.18.37.11
object network NVR1
access-list NVR1 extended permit tcp host 200.188.213.171 host 172.18.37.11 eq 8080
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NAT-LAN
nat (inside,outside) dynamic interface
object network NVR-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
access-group NVR1 in interface outside
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:aaefa4d7d2573c97909739849e2a816b
: end
FW001(config)#

With:

visco — Wed, 08 Feb 2017 19:09:09 GMT

With:

access-list NVR1 extended permit tcp host 200.188.213.171 host 172.18.37.11 eq 8080

You are restricting to host 200.188.213.171 to 172.18.37.11.

for testing, allow "any" and test from a different outside connection....rather than testing in and out same firewall.

Just for a test:

access-list NVR1 permit tcp any host 172.18.37.11 eq 8080

and test from another outside connection, other than the same firewall.

Doubt, this ip need to access

patrickernane — Thu, 09 Feb 2017 00:03:07 GMT

Doubt, this ip need to access 200.188.213.171:8080 and 200.188.213.171:8081

Being that 200.188.213.171 ---> 172.18.37.11:8080
  200.188.213.171 ---> 172.18.37.12:8081 but this configuration of mine only works one and not both simultaneously



FW001(config)# end
FW001# show run
FW001# show running-config
: Saved

:
: Serial Number: JAD193400NV
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 nameif outside
 security-level 0
 ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
 management-only
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network NVR2-172.18.37.12
 host 172.18.37.12
object network NVR1-172.18.37.11
 host 172.18.37.11
access-list NVR1 extended permit tcp any host 172.18.37.11 eq 8080
access-list NVR2 extended permit tcp any host 172.18.37.12 eq 8081
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NVR2-172.18.37.12
 nat (inside,outside) static interface service tcp 8081 8081
object network NVR1-172.18.37.11
 nat (inside,outside) static interface service tcp 8080 8080
access-group NVR1 in interface outside
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:c986fc9bf1f732e8d986b72b4951b733
: end
FW001#