topic 6 in Network Security

port forwarding in a cisco ASA 5505

flyntransam — Tue, 12 Mar 2019 07:18:13 GMT

Having trouble with my ASA. Not the greatest with cisco command line.

Anyways, I have it setup after my cable modem and before my router. Ideally, it should just forward all traffic to my router and let it deal with it.

Trying to setup a Plex server, and getting this error:

6 Feb 14 2016 23:17:58 54.229.51.0 43297 192.168.2.1 32400 Built inbound TCP connection 23926181 for outside:54.229.51.0/43297 (54.229.51.0/43297) to inside:192.168.2.1/32400 (67.175.30.50/32400)
6 Feb 14 2016 23:17:58 54.229.51.0 43297 192.168.2.1 32400 Routing failed to locate next hop for TCP from outside:54.229.51.0/43297 to inside:192.168.2.1/32400

I've also tried setting the network obj plex to both my router's ip or the plex server's ip with the same error as above.

Any ideas or good articles that can point me in the right direction?

Thanks,

Brian

asa's ip is 192.168.1.1

Router is 192.168.2.1

Plex server 192.168.2.80

ASA Version 9.2(4)
!
hostname FIREWALL
domain-name *********
enable password ************
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ***************
names
ip local pool VPN 192.168.3.1-192.168.3.10 mask 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
boot system disk0:/asa921-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
domain-name ********
object network obj_any
subnet 0.0.0.0 0.0.0.0
object service rdp
service tcp source eq 1001 destination eq 1001
description rdp
object network Brians_comp
host 192.168.2.75
object network Internal_RDP_Server-2
object network TV_Hopper
host 192.168.2.103
object network NETWORK_OBJ_192.168.3.0_28
subnet 192.168.3.0 255.255.255.240
object network VPN_Main
host 192.168.2.75
description VPN_Main
object network Plex
host 192.168.2.1
object-group service customrdp tcp
description customrdp
port-object eq 1001
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service TV_Hooper tcp-udp
port-object eq 50001
object-group service BT tcp-udp
description bt
port-object eq 1080
object-group service plexservice tcp-udp
port-object eq 32400
access-list outside-entry extended permit tcp any interface outside eq 5678
access-list inbound extended permit object-group TCPUDP any object TV_Hopper object-group TV_Hooper
access-list inbound extended permit object-group TCPUDP any object Plex object-group plexservice
access-list inbound extended permit icmp host 8.8.8.8 any
access-list inbound extended permit object rdp any object Brians_comp inactive
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
pager lines 24
logging enable
logging asdm debugging
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-751.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.3.0_28 NETWORK_OBJ_192.168.3.0_28 no-proxy-arp route-lookup
!
object network obj_any
nat (inside,outside) dynamic interface
object network TV_Hopper
nat (inside,outside) static interface service tcp 50001 50001
object network VPN_Main
nat (inside,outside) static interface service tcp pptp pptp
object network Plex
nat (inside,outside) static interface service tcp 32400 32400
access-group inside_access_in in interface inside
access-group inbound in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
http ********* 255.255.255.255 outside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df outside
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca******
quit
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 900
ssh stricthostkeycheck
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside

vpnclient mode client-mode
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.10 inside
dhcpd dns 192.168.2.12 8.8.8.8 interface inside
dhcpd auto_config outside interface inside
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter updater-client enable
dynamic-filter use-database
dynamic-filter enable
ssl encryption aes128-sha1 3des-sha1
webvpn
enable inside
enable outside
anyconnect-essentials
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol l2tp-ipsec
default-domain value *******
group-policy DefaultRAGroup_1 internal
group-policy DefaultRAGroup_1 attributes
vpn-tunnel-protocol l2tp-ipsec
default-domain value *********
username ***
username ****
tunnel-group DefaultRAGroup general-attributes
address-pool VPN
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2
!
class-map global-class
match default-inspection-traffic
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class global-class
inspect pptp
class class-default
user-statistics accounting
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
hpm topN enable
: end

What it looks like to me is

jj27 — Mon, 15 Feb 2016 16:38:39 GMT

What it looks like to me is your ASA does not know how to get to your Plex server or the 192.168.2.0/24 subnet.

Your ASA is on 192.168.1.0/24 network:

interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0

There is no route to send traffic for the 192.168.2.0/24 subnet, so try adding in a route for it to whichever device can get it there.

route inside 192.168.2.0 255.255.255.0 x.x.x.x

Or, put your ASA on the 192.168.2.0/24 subnet with your router.

I tried this:

flyntransam — Tue, 16 Feb 2016 02:40:48 GMT

I tried this:

route inside 192.168.2.0 255.255.255.0 192.168.2.1

But seems to be the same result. Also tried pinging 192.168.2.1 from the asa with no hits back.

Router ip is 192.168.2.1

That's not going to work.

jj27 — Tue, 16 Feb 2016 03:48:54 GMT

That's not going to work. Your router needs to have an interface on the 192.168.1.0 network or you need to put your ASA on the 192.168.2.0 network which may be the easiest in your case.

It's currently setup so the

flyntransam — Tue, 16 Feb 2016 18:12:24 GMT

It's currently setup so the asa pulls my wan IP and uses 192.168.1.1 as the lan.

My router pulls WAN ip of 192.168.1.2 and a Lan ip of 192.168.2.1.

I played with it some as here is what I am getting:

Feb 15 2016

15:02:20

52.19.16.34

37163

192.168.2.80

32400

Built inbound TCP connection 24004464 for outside:52.19.16.34/37163 (52.19.16.34/37163) to inside:192.168.2.80/32400 (wanIP/32400)

Feb 15 2016

15:02:20

52.19.16.34

Built local-host outside:52.19.16.34

Feb 15 2016

15:02:20

192.168.2.80

Built local-host inside:192.168.2.80

But when I do a port scan of it, it comes back filtered.

Ok, your topology makes sense

jj27 — Tue, 16 Feb 2016 18:30:43 GMT

Ok, your topology makes sense now. I assume your Plex server is either directly connected to the router or some sort of switch.

What type of router are we talking about here? A Cisco router? A home/SMB router like a Linksys/etc? Is the router performing any NAT for the 192.168.2.0/24 network?

Try:

route inside 192.168.2.0 255.255.255.0 192.168.1.2

6

flyntransam — Tue, 16 Feb 2016 18:34:55 GMT

Feb 16 2016

06:06:47

54.194.180.39

36512

192.168.2.80

32400

Teardown TCP connection 24075085 for outside:54.194.180.39/36512 to inside:192.168.2.80/32400 duration 0:00:30 bytes 0 SYN Timeout

router is a TP Link TL-ER5120

flyntransam — Tue, 16 Feb 2016 18:37:51 GMT

router is a TP Link TL-ER5120.

Pretty much no nat

There is a port forward I setup in it for port 32400 to forward all traffic to 192.168.2.80.

Brian

That is how I currently have

flyntransam — Tue, 16 Feb 2016 18:40:38 GMT

That is how I currently have it setup in the ASA.

route inside 192.168.2.0 255.255.255.0 192.168.1.2

Without seeing the

jj27 — Tue, 16 Feb 2016 18:47:11 GMT

Without seeing the configuration of that router, it will be tough. You can try sending the port 32400 to 192.168.1.2 on your ASA instead of 192.168.2.80, then your router will see it on 1.2 and forward it to 192.168.2.80 on the inside.

Still get the syn error.

flyntransam — Tue, 16 Feb 2016 18:51:12 GMT

Still get the syn error.

Feb 16 2016

06:25:13

54.194.180.39

46461

192.168.1.2

32400

Teardown TCP connection 24077512 for outside:54.194.180.39/46461 to inside:192.168.1.2/32400 duration 0:00:30 bytes 0 SYN Timeout

That means the connection was

jj27 — Tue, 16 Feb 2016 18:54:56 GMT

That means the connection was built and the ASA did not receive a response within 30 seconds, so something is messed up in your router configuration.

Re: port forwarding in a cisco ASA 5505

bruno.chung@cvetech.com — Mon, 31 Dec 2018 21:29:07 GMT

did you ever get this resolved?