topic Hi Hugo, in Network Security

Inbound traffic is denied by ASA including external access to ASDM

Hugo Rosado — Tue, 12 Mar 2019 06:51:52 GMT

HI Guys,

I have a vodafone link into the office, the vodafone link goes to a ONT and from the ONT goes to a ASA 5505 running ASDM version 9.1(5), I have enabled remote access to the firewall over HTTPS,everytime I try to remotely access ASM it fails to establish the connection, I can see on teh firewall that the traffice is being blocked but I cannot understand why.

All traffic from teh LAN is going outside correctly the problem is all traffic from the internet into the ASA is being blocked.

Because of the configuration I had to build a trunk link beteween the ONT and the ASA so i can get the public IP on the ASA.

Configuration bellow:

ASA Version 9.1(5)

hostname ASA

domain-name ASA

enable password 8uN1rmXrP82bg6Tr encrypted

names

ip local pool Vpn_Pool 192.168.10.200-192.168.10.210 mask 255.255.255.0

interface Ethernet0/0

switchport trunk allowed vlan 5,10,20,30,40,50,100,172

switchport mode trunk

interface Ethernet0/1

interface Ethernet0/2

switchport trunk allowed vlan 5,10,20,30,40,100,172

switchport trunk native vlan 5

switchport mode trunk

interface Ethernet0/3

interface Ethernet0/4

switchport access vlan 20

interface Ethernet0/5

switchport access vlan 20

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

no ip address

interface Vlan5

description Switch_Trunk

nameif NativeVlan

security-level 0

ip address 192.168.5.1 255.255.255.0

interface Vlan10

description Production

nameif Production

security-level 100

ip address 192.168.10.1 255.255.255.0

interface Vlan20

description Telephony

nameif Telephony

security-level 100

ip address dhcp setroute

interface Vlan30

description Design

nameif Design

security-level 100

ip address 192.168.30.1 255.255.255.0

interface Vlan40

description Guest

no forward interface Vlan20

nameif Guest

security-level 100

ip address 192.168.40.1 255.255.255.0

interface Vlan50

management-only

nameif Management_Vlan

security-level 0

ip address 192.168.50.1 255.255.255.0

interface Vlan100

nameif VodafoneTrunk

security-level 0

ip address dhcp setroute

interface Vlan172

nameif Pineapple_WiFi

security-level 0

ip address 172.16.42.2 255.255.255.0

ftp mode passive

dns domain-lookup VodafoneTrunk

dns server-group DefaultDNS

name-server 8.8.8.8

name-server 8.8.4.4

domain-name ASA

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network Production

subnet 192.168.10.0 255.255.255.0

object network Draytech_Router

host 192.168.20.1

object network Synology

host 192.168.20.9

object service Ftp

service tcp source eq ftp destination eq ftp

description Ftp

object network ASDM

host 192.168.10.1

object network External

host

object network Ftp_Redirect

host 192.168.20.9

object network obj_Synology

host 192.168.20.9

object network obj_Synology2

host 192.168.20.9

object network NETWORK_OBJ_192.168.10.192_27

subnet 192.168.10.192 255.255.255.224

object-group service Ftpinside tcp

port-object eq 3232

object-group service DM_INLINE_TCP_2 tcp

group-object Ftpinside

port-object eq ftp

port-object eq ftp-data

object-group service DM_INLINE_SERVICE_1

service-object ip

service-object tcp

service-object tcp destination eq www

service-object icmp

service-object udp

object-group service DM_INLINE_SERVICE_2

service-object ip

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

service-object icmp

service-object udp

service-object tcp source eq ftp destination eq ftp

object-group service DM_INLINE_SERVICE_3

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq echo

service-object tcp destination eq www

service-object tcp destination eq https

service-object udp destination eq echo

object-group service DM_INLINE_SERVICE_4

service-object ip

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

service-object icmp

service-object udp

object-group service DM_INLINE_SERVICE_5

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

object-group service DM_INLINE_SERVICE_6

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

object-group service DM_INLINE_SERVICE_7

service-object ip

service-object icmp

service-object udp

service-object tcp destination eq www

service-object tcp destination eq https

service-object tcp destination eq ftp

service-object tcp destination eq ftp-data

object-group network Group_Object

network-object 172.16.42.0 255.255.255.0

network-object 192.168.10.0 255.255.255.0

network-object 192.168.30.0 255.255.255.0

network-object 192.168.40.0 255.255.255.0

object-group service DM_INLINE_SERVICE_9

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

object-group service DM_INLINE_SERVICE_10

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

object-group service DM_INLINE_SERVICE_12

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

object-group service DM_INLINE_SERVICE_14

service-object ip

service-object icmp

service-object udp

service-object tcp

service-object tcp destination eq www

service-object tcp destination eq https

service-object tcp destination eq ftp

service-object tcp destination eq ftp-data

object-group service DM_INLINE_SERVICE_8

service-object tcp

service-object tcp destination eq ftp

service-object tcp destination eq www

service-object tcp destination eq ftp-data

object-group service Inline_Service_1

service-object icmp echo-reply

service-object tcp destination eq ftp

service-object tcp destination eq ftp-data

service-object tcp destination eq www

service-object tcp destination eq https

service-object icmp echo

object-group service DM_INLINE_SERVICE_13

service-object ip

service-object tcp

service-object tcp destination eq ftp

service-object tcp destination eq ftp-data

object-group service DM_INLINE_TCP_1 tcp

port-object eq ftp

port-object eq ftp-data

access-list VodafoneTrunk_access_in_3 extended permit tcp any host 192.168.20.9 object-group DM_INLINE_TCP_2

access-list VodafoneTrunk_access_out extended permit object-group DM_INLINE_SERVICE_2 object Production any

access-list VodafoneTrunk_access_out extended permit object-group DM_INLINE_SERVICE_5 192.168.30.0 255.255.255.0 any4

access-list VodafoneTrunk_access_out extended permit object-group DM_INLINE_SERVICE_4 192.168.40.0 255.255.255.0 any4

access-list VodafoneTrunk_access_out extended permit object-group DM_INLINE_SERVICE_13 interface Telephony any

access-list VodafoneTrunk_access_in extended permit object-group DM_INLINE_SERVICE_8 any host 192.168.20.9

access-list VodafoneTrunk_access_in extended permit object-group DM_INLINE_SERVICE_12 any4 interface Guest

access-list VodafoneTrunk_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 interface Production

access-list VodafoneTrunk_access_in extended permit object-group DM_INLINE_SERVICE_6 any4 interface Design

access-list Production extended permit object-group DM_INLINE_SERVICE_3 any any

access-list Telephony_access_out extended permit object-group DM_INLINE_SERVICE_7 any any

access-list Guest_access_out extended permit object-group DM_INLINE_SERVICE_10 interface Guest 192.168.20.0 255.255.255.0

access-list Guest_access_out extended permit object-group DM_INLINE_SERVICE_9 interface Guest any4

access-list Telephony_access_in extended permit object-group DM_INLINE_SERVICE_14 any4 any4

access-list management extended permit ip any any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu NativeVlan 1500

mtu Production 1500

mtu Telephony 1500

mtu Design 1500

mtu Guest 1500

mtu Management_Vlan 1500

mtu VodafoneTrunk 1500

mtu Pineapple_WiFi 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (Production,VodafoneTrunk) source static any interface

nat (Design,VodafoneTrunk) source static any interface

nat (Guest,VodafoneTrunk) source static any interface

nat (Production,Telephony) source static any interface

nat (Design,VodafoneTrunk) source static any any destination static NETWORK_OBJ_192.168.10.192_27 NETWORK_OBJ_192.168.10.192_27 no-proxy-arp route-lookup

access-group Telephony_access_in in interface Telephony

access-group Telephony_access_out out interface Telephony

access-group Guest_access_out out interface Guest

access-group management in interface Management_Vlan

access-group VodafoneTrunk_access_out out interface VodafoneTrunk

route VodafoneTrunk 0.0.0.0 0.0.0.0 46.189.254.202 1 track 1

route Telephony 0.0.0.0 0.0.0.0 192.168.20.1 254

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication enable console LOCAL

aaa authentication http console LOCAL

http server enable

http 172.16.42.0 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 Production

http 0.0.0.0 0.0.0.0 VodafoneTrunk

http 0.0.0.0 0.0.0.0 Telephony

http 0.0.0.0 0.0.0.0 Management_Vlan

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

sla monitor 123

type echo protocol ipIcmpEcho 46.189.129.1 interface NativeVlan

num-packets 3

frequency 10

sla monitor schedule 123 life forever start-time now

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

crypto ipsec security-association pmtu-aging infinite

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS

crypto map VodafoneTrunk_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map VodafoneTrunk_map interface VodafoneTrunk

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto ca trustpoint ASDM_TrustPoint0

enrollment terminal

fqdn ASA

subject-name CN=ASA.null,O=ASA,C=PT

crl configure

crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0

enrollment self

subject-name CN=192.168.10.1,CN=ASA

crl configure

crypto ca trustpool policy

crypto ca certificate chain _SmartCallHome_ServerCA

certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130

0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117

30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504

0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56

65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043

65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b

30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65

74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420

68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329

3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365

63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7

0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597

a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc

7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8

18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201

db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868

7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101

ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8

45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777

2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a

1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973

69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403

02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969

6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b

c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603

551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355

1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609

2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80

4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc

481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

6c2527b9 deb78458 c61f381e a4c4cb66

quit

crypto ikev1 enable VodafoneTrunk

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

track 1 rtr 123 reachability

telnet timeout 5

no ssh stricthostkeycheck

ssh 0.0.0.0 0.0.0.0 NativeVlan

ssh 0.0.0.0 0.0.0.0 Production

ssh 0.0.0.0 0.0.0.0 VodafoneTrunk

ssh timeout 5

ssh key-exchange group dh-group14-sha1

console timeout 0

dhcp-client client-id interface Telephony

dhcpd auto_config NativeVlan

dhcpd address 192.168.10.20-192.168.10.200 Production

dhcpd dns 8.8.8.8 8.8.4.4 interface Production

dhcpd lease 28800 interface Production

dhcpd domain Production interface Production

dhcpd enable Production

dhcpd address 192.168.30.20-192.168.30.200 Design

dhcpd dns 8.8.8.8 8.8.4.4 interface Design

dhcpd lease 28800 interface Design

dhcpd domain Design interface Design

dhcpd enable Design

dhcpd address 192.168.40.20-192.168.40.200 Guest

dhcpd dns 8.8.8.8 8.8.4.4 interface Guest

dhcpd lease 28800 interface Guest

dhcpd domain Guest interface Guest

dhcpd enable Guest

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_Launcher_Access_TrustPoint_0 Production vpnlb-ip

ssl trust-point ASDM_Launcher_Access_TrustPoint_0 Production

webvpn

enable VodafoneTrunk

no anyconnect-essentials

group-policy SSL_VPN internal

group-policy SSL_VPN attributes

vpn-tunnel-protocol ssl-clientless

webvpn

url-list none

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 8.8.8.8 8.8.4.4

vpn-tunnel-protocol l2tp-ipsec

default-domain value ASA

username Test password UCZGeoyr6B9GOi4H encrypted privilege 15

tunnel-group DefaultRAGroup general-attributes

address-pool Vpn_Pool

default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group DefaultRAGroup ppp-attributes

authentication ms-chap-v2

tunnel-group L2tp type remote-access

tunnel-group VPN_In type remote-access

tunnel-group VPN_In general-attributes

default-group-policy SSL_VPN

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

service-policy global_policy global

prompt hostname context

call-home reporting anonymous

Cryptochecksum:a1e1a490046247e603b8dce367911007

: end

Hi Hugo,

Akshay Rastogi — Tue, 10 Nov 2015 12:33:23 GMT

Hi Hugo,

I could see that you have configured a lot of manula nat statement the way which is not recommanded.

Is their any specific requirement why you wish to have access to all the internal host from outside? If yes, then there should be one to one nat statement or Port redirections.

nat (Production,VodafoneTrunk) source static any interface

nat (Design,VodafoneTrunk) source static any interface

nat (Guest,VodafoneTrunk) source static any interface

nat (Production,Telephony) source static any interface

All the above indicates many to one static one scenarios. With this, you would be able to go out to the internet but only the least real IP address would be able to get the traffic intiated from internet. If you wish to have internet connectivity for your lan networks then create Object/Auto NAT.

Something like this :

object network obj-any-production

subnet 0 0

nat (Production,VodafoneTrunk) dynamic interface

Same thing for other internal interfaces. (as i could see a lot of internal lan are mapped to same vodaphone trunk, there could be pool exhaustion issue. Try to use more ip as mapped instead of this single for all internal interface).

The reason why ASDM is not working on Outside is because you have configured 'Webvpn' on Vodaphone trunk interface(it also uses port 443). map a different port in webvpn or map a different port in http. For latter one, configure this :

http server enable 8443

and then access your asdm as 'https://<vodaphonetrunk ip>:8443'

Hope it helps.

Regards,

Akshay Rastogi

Remember to mark answer as correct if it answers your queries or rate the helpful posts.

Hi Hugo

rodrigog — Tue, 10 Nov 2015 13:31:52 GMT

Hi Hugo

Change this

nat (Production,VodafoneTrunk) source static any interface

nat (Design,VodafoneTrunk) source static any interface

nat (Guest,VodafoneTrunk) source static any interface

nat (Production,Telephony) source static any interface

nat (Production,VodafoneTrunk) source dynamic any interface

nat (Design,VodafoneTrunk) source dynamic any interface

nat (Guest,VodafoneTrunk) source dynamic any interface

nat (Production,Telephony) source dynamic any interface

After adding the dynamic remove the static

no nat (Production,VodafoneTrunk) source static any interface

no nat (Design,VodafoneTrunk) source static any interface

no nat (Guest,VodafoneTrunk) source static any interface

no nat (Production,Telephony) source static any interface

As per the Telephony nat change i am suggesting it in case this interface would be a backup interface for your interface circuit in case the main line fails

If not don't change the nat for that interface

Then check if webvpn works and then ASDM

https://ip-address-of-the-ASA/+CSCOE+/logon.html

In order to access ASDM, you can use this URL:

https://ip-address-of-the-ASA/admin

Refer to

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118842-technote-asdm-00.html

The static is redirecting all Internet traffic sourced from the outside with the destination being the ASA IP to the internal network and not the ASA managment plane that is the one needed to open ASDM and web-vpn

After the nat change all service enable on the ASA should start working from the outside world.

Let me know the results

Rodrigo Gutierrez

Hi Akshay,

Hugo Rosado — Tue, 10 Nov 2015 15:22:13 GMT

Hi Akshay,

Thank you for your response, I will give this a try later on.

The reason to have so many static Nat rules is the fact that I was trying to achive a port translation that would translate FTP traffic that would come in on the Vodafonetrunk interface on port 3232 and would then be translated to port 21 and forward to a internal FTP server, i try to achieve this with object groups together with nat rules but with no luck, is this possible?

Once I try your configuration I will confirm with you, once again thank you for your response.

Hugo

Thanks for your response,

Hugo Rosado — Tue, 10 Nov 2015 15:28:52 GMT

Thanks for your response, will let you know.

Hugo

Hi Rodrigo,

Hugo Rosado — Wed, 11 Nov 2015 12:12:13 GMT

Hi Rodrigo,

At the moment I am not using webVpn, I did the changes and it worked as a treat, i still cannot access ASDM remotely, I have changed the incoming ports of ASDM to 8443 but I get a timeout on the connection, on the ASA I get a Block tcp connection from the external IP Im trying to access in.

Thanks in advance

Hello Hugo,

rodrigog — Wed, 11 Nov 2015 13:26:18 GMT

Hello Hugo,

Can you get the output of show ASP table socket?

Also can you run the next packet tracer on the ASA

packet in VodafoneTrunk tcp 8.8.8.8 1025 ''public ip address of the ASA'' 8443

Also try getting a capture of the packets arriving the on the ASA and the exact log of the drop.

Many Thanks for your reply,

Hugo Rosado — Wed, 11 Nov 2015 14:27:57 GMT

Many Thanks for your reply, please find bellow and on attach the information:

Protocol Socket State Local Address Foreign Address

SSL 00035118 LISTEN 192.168.10.1:8443 0.0.0.0:* SSL 00045908 LISTEN 192.168.50.1:8443 0.0.0.0:* TCP 000766c8 LISTEN 192.168.5.1:22 0.0.0.0:* TCP 000934f8 LISTEN 192.168.10.1:22 0.0.0.0:* SSL 000a2bf8 LISTEN Public_Ip:8443 0.0.0.0:* TCP 000dca68 LISTEN Public_Ip:22 0.0.0.0:* SSL 01562388 LISTEN 192.168.1.17:8443 0.0.0.0:* TCP 02d8d4b8 ESTAB 192.168.10.1:22 192.168.10.39:50258

Hello Hugo,

rodrigog — Wed, 11 Nov 2015 14:44:04 GMT

Hello Hugo,

there is Still and unnat going on

Did you removed the statics?

Can you get the output of sh run nat

Also try clearing the xlates of the ASA

This will create a 5 minute downtime

After clearing them try connecting via ASDM again.

Hi Hugo,

Akshay Rastogi — Wed, 11 Nov 2015 14:44:13 GMT

Hi Hugo,

From the output I could see that your outside ip is listening on port 8443. From the drops on ASA, i could see that the destination port is showing as 443.

Could you please access the ASDM like this :

https://<ip-address-on interface:8443>

Regards,

Akshay Rastogi

It work nicely. Thanks H

Hugo Rosado — Thu, 12 Nov 2015 18:40:55 GMT

It work nicely.

Thanks