topic ASA 5506 Port Forwarding in Network Security

ASA 5506 Port Forwarding

Joshuabowers — Tue, 12 Mar 2019 08:46:06 GMT

Hello,

I have a 5506-x that needs to port forward a range of ports. My outside IP is also Dynamic from the ISP.

So far I made a Network\Service Object for the ports I want to use in the port forwarding.

object service Service_OBJ_IPcamPorts_UDP
service udp source range 8186 8191 destination range 8186 8191

object service Service_OBJ_IPcamPort_TCP
service tcp source range 8186 8191 destination range 8186 8191

object network Network-Object-SOHO-Cisco-Router
host 10.0.0.2

After the creation of the objects I'm unsure how to nat and make the acl to allow the packets.

nat (CISCO-SOHO-Router,outside) source static Network-Object-SOHO-Cisco-Router Network-Object-SOHO-Cisco-Router service Service_OBJ_IPcamPort_TCP Service_OBJ_IPcamPort_TCP

Then my Current ACL

access-list outside_access_in line 2 extended permit tcp any range 8186 8191 host 10.0.0.2 range 8186 8191 log disable (hitcnt=0) 0x95da1b49
access-list outside_access_in line 2 extended permit udp any range 8186 8191 host 10.0.0.2 range 8186 8191 log disable (hitcnt=0) 0x401fe7ac

any is the internet

10.0.0.2 is a SOHO home router that is nating again with the same port ranges

Hi,

Mohammed al Baqari — Thu, 12 Jan 2017 06:38:07 GMT

Hi,

Can you capture traffic on your outside interface to make sure that you are receiving traffic from SOHO using the right IP/Port

Hi,

Aref Alsouqi — Thu, 12 Jan 2017 23:43:54 GMT

Hi,

You need to translate the private IP address 10.0.0.2 to a public one. You can use the outside interface public IP, similar to this:

nat (CISCO-SOHO-Router,outside) source static Network-Object-SOHO-Cisco-Router interface service Service_OBJ_IPcamPort_TCP Service_OBJ_IPcamPort_TCP

Another thing, I am not sure if the incoming traffic would be sourcing from the same destination range ports toward the 10.0.0.2. If not please correct the ACLs to read as following:

access-list outside_access_in extended permit tcp any host 10.0.0.2 range 8186 8191 log disable
access-list outside_access_in extended permit udp any host 10.0.0.2 range 8186 8191 log disable

Also please remove the destination range from the service object.

Regards,

Aref

I found out my main problem.

Joshuabowers — Fri, 13 Jan 2017 20:12:29 GMT

I found out my main problem.

for acls for natting, only one acl needs to be Specified for the node that has the natted service. I believe the asa will build acls on there own to allow non nated traffic to come back.

ASA by default inspects the

Aref Alsouqi — Fri, 13 Jan 2017 20:29:37 GMT

ASA by default inspects the traffic leaving and allows the returning traffic to pass through without any need for any ACL, but if you want to allow the traffic initiated from outside to inside, you need an ACL entry to allow it.

Regards,

Aref