topic Hi, in Network Security

Problem with cisco 5510 port mapping

raidokuvarnet — Tue, 12 Mar 2019 07:36:50 GMT

Hello,

My device Cisco ASA 5510, ASA 8.4(2), ASDM 6.4(5)206

What I try to achieve.

1) Host 10.10.11.108 listening port 8080

2) Trying to access it from WAN e.g port 8090

I tried following commands:

object network 10.10.11.108_8080
host 10.10.11.108
nat (LAN1,WAN) static interface service tcp 8080 8090

access-list WAN_access_in line 11 extended permit tcp any object 10.10.11.108_8080 eq 8080
access-group WAN_access_in in interface WAN

But I don't gett access. Can someone help me to solve this case?

Hi,

Aditya Ganjoo — Wed, 13 Apr 2016 07:54:56 GMT

Hi,

Can you share the packet tracer output for the concerned traffic ?

packet-tracer input WAN tcp 4.2.2.2 6767 <interface> 8090 det

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Hello,

raidokuvarnet — Thu, 14 Apr 2016 14:00:15 GMT

Hello,

I don't know how to save packet tracer output, but here is a screenshot of it.

Hi,

Aditya Ganjoo — Thu, 14 Apr 2016 15:14:37 GMT

Hi,

Packet-tracer is showing a NAT RPF drop.

So the return traffic is taking a different NAT.

Could you remove the existing NAT and create a manual NAT ?

nat (inside,outside) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090

This should work !!!

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Actually you have used the

Marius Gunnerud — Thu, 14 Apr 2016 20:13:02 GMT

Actually you have used the wrong IP in the destination of the packet-tracer. it should not be 10.10.11.108, so replace it with the WAN interface IP and then run the packet tracer again.

Please remember to select a correct answer and rate helpful posts

Okay, lets give it another

raidokuvarnet — Fri, 15 Apr 2016 06:08:48 GMT

Okay, lets give it another try:

Try Aditya's suggestion of

Marius Gunnerud — Fri, 15 Apr 2016 06:25:34 GMT

Try Aditya's suggestion of removing the object NAT statement and configuring the NAT in manual NAT.

nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090

If that still does not work, please post a full running config of the ASA (remove any usernames, passwords and public IPs)

Please remember to select a correct answer and rate helpful posts

Result of the command:

raidokuvarnet — Fri, 15 Apr 2016 13:40:52 GMT

Result of the command:

"nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp 8080 tcp 8090"

nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp 8080 tcp ^8090

ERROR: % Invalid input detected at '^' marker.

You are missing the - tcp

Marius Gunnerud — Fri, 15 Apr 2016 13:43:09 GMT

You are missing the - tcp-8080 and tcp-8090

Please remember to select a correct answer and rate helpful posts

Result of the command: "nat

raidokuvarnet — Fri, 15 Apr 2016 13:44:51 GMT

Result of the command: "nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090"

ERROR: tcp-8080 is not a valid service object name

ah ok...you have probably

Marius Gunnerud — Fri, 15 Apr 2016 13:48:35 GMT

ah ok...you have probably configure the service object incorrectly by using the destination keyword.

You need to configure it as follows:

object-group service tcp-8080 tcp
port-object eq 8080

Please remember to select a correct answer and rate helpful posts

Ran these commands, but error

raidokuvarnet — Mon, 18 Apr 2016 06:19:44 GMT

Ran these commands, but error is the same:

Result of the command: "nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090"

ERROR: tcp-8080 is not a valid service object name

Should it be?:

object-group service tcp-8080 tcp
service-object eq 8080

is this the correct command

raidokuvarnet — Tue, 19 Apr 2016 10:08:07 GMT

is this the correct command to run?

object-group service tcp-8080 tcp
service-object eq 8080

Try using an underscore

Marius Gunnerud — Tue, 19 Apr 2016 10:23:37 GMT

Try using an underscore instead of hyphen. Also it is port-object not service-object.

object-group service tcp_8080 tcp
port-object eq 8080

Please remember to select a correct answer and rate helpful posts

Result of the command:

raidokuvarnet — Wed, 20 Apr 2016 06:50:01 GMT

Result of the command: "object-group service tcp_8080 tcp"

The command has been sent to the device

Result of the command: "port-object eq 8080"

The command has been sent to the device

--------------------

Result of the command: "nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp_8080 tcp-8090"

ERROR: tcp_8080 is not a valid service object name

Result of the command: "nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp_8080 tcp_8090"

ERROR: tcp_8080 is not a valid service object name

Hi,

Aditya Ganjoo — Wed, 20 Apr 2016 07:01:41 GMT

Hi,

Please use the following command:

object service tcp-8090
service tcp source eq 8090

object service tcp-8080
service tcp destination eq 8080

nat (inside,outside) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090

Regards,

Aditya

Okay, these commands were

raidokuvarnet — Wed, 20 Apr 2016 07:20:35 GMT

Okay, these commands were successful. Right now I can not access my service by port 8090. Do I need to configure Access Rule also?

Hi,

Aditya Ganjoo — Wed, 20 Apr 2016 07:25:13 GMT

Hi,

Use a packet tracer command:

packet-tracer input wan tcp 4.2.2.2 8888 <interface ip> 8090 det

Regards,

Aditya

cisco3.png

raidokuvarnet — Wed, 20 Apr 2016 07:31:31 GMT

Hi,

Aditya Ganjoo — Wed, 20 Apr 2016 07:34:37 GMT

Hi,

Please try opening the ACL on the WAN interface for the traffic.

Regards,

Aditya