topic That looks better.Can you in Network Security

Port Forward 46611 on ASA 5515

chris.hall6777 — Tue, 12 Mar 2019 06:45:25 GMT

I work mainly with Barracuda firewalls and my Cisco command line is bad bad.

I have a cisco 5515 at 216.x.x.39 and I need to forward port 46611 to an internal ip address 10.10.3.7 port 9000

my inside interface is nas-main

oustide interface is twtc

I tried using ASDM and it didn't work and currently I am trying command line, but I keep getting error messages with my nat command.

Also, please detailed help would be appreciated, as I said my cisco command line experience is lacking.

Thanks in adavance.

Hi

Henrik Grankvist — Thu, 15 Oct 2015 20:10:20 GMT

The configuration could be quite tricky, but this would work:

object network obj-10.10.3.7
 host 10.10.3.7

object service tcp-eq-9000
 service tcp source eq 9000

object service tcp-eq-46611
 service tcp source eq 46611

nat (nas-main,twtc) source static obj-10.10.3.7 interface service tcp-eq-46611 tcp-eq-9000

HenrikThank you, but when I

chris.hall6777 — Thu, 15 Oct 2015 20:28:18 GMT

Henrik

Thank you, but when I typed that in I got an overlay message for that ip on port 9000

so what would it take to move the configuration to ip 216.x.x.42 (which is an ip address in my external pool) Still the same internal ip address and ports. Just need it to use a different external ip address.

Sorry, but the guys needing this are not that forth coming on info and they don't know what is setup already on the cisco. I have verified there is nothing programmed for 216.x.x.42.

Thanks again for the help

Hi,

Rishabh Seth — Fri, 16 Oct 2015 04:28:35 GMT

Hi,

Use the same config as Henrik has suggested with one small change.

nat (nas-main,twtc) source static obj-10.10.3.7 216.x.x.42 service tcp-eq-46611 tcp-eq-9000

Hope it answers your query

Thanks,

R.Seth

Rate if ti helps!!!

thank you for the help but I

chris.hall6777 — Fri, 16 Oct 2015 16:46:04 GMT

thank you for the help but I am still unable to get through. A thought occurred while doing this. could it be https causing the problem?

This is how I am accessing the internal server https://216.x.x.39

I was able to setup a 1 to 1 nat on https and get to the internal server. But, I am still unable to get the port 46611 part of this to work.

ChrisWhat was the NAT command

Jon Marshall — Fri, 16 Oct 2015 17:04:02 GMT

Chris

What was the NAT command you used for https and was this the only static NAT command relating to the server ?

Jon

ok...well I thought I was

chris.hall6777 — Fri, 16 Oct 2015 20:27:14 GMT

ok...well I thought I was smart but now, no one can get to the internet our out outside interface twtc.

I rebooted the router and got an error message about a nat command. I have attached the jpg for it.

Also here is the listing of nat commands in config

Help??!!!

Manual NAT Policies (Section 1)
1 (NAS-Main) to (TWTC) source static any interface unidirectional
translate_hits = 0, untranslate_hits = 0
2 (NAS-QA1) to (TWTC) source static any interface unidirectional
translate_hits = 0, untranslate_hits = 0
3 (NAS-QA2) to (TWTC) source static any interface unidirectional
translate_hits = 0, untranslate_hits = 0
4 (BTC) to (TWTC) source static BTC-ClearOS BTC-Email inactive
translate_hits = 0, untranslate_hits = 0
5 (BTC) to (TWTC) source static BTC-Metric-Private BTC-Metric-Public service E
ncryptedMail EncryptedMail
translate_hits = 0, untranslate_hits = 0
6 (BTC) to (TWTC) source static BTC-Email-Private BTC-Email-Public service BTC
-EmailPort25 BTC-EmailPort25
translate_hits = 0, untranslate_hits = 0
7 (BTC) to (TWTC) source static BTC-Email-Private BTC-Email-Public service BTC
-ICMP BTC-ICMP
translate_hits = 0, untranslate_hits = 0
8 (NAS-Main) to (TWTC) source static ENGR-OpenVPN NASMAIN-Public service ENGR-
VPN-UDP-1194 ENGR-VPN-UDP-1194
translate_hits = 0, untranslate_hits = 0
9 (NAS-Main) to (TWTC) source static ENGR-OpenVPN DM_INLINE_NETWORK_1 service
ENGR-VPN-1194 ENGR-VPN-1194
translate_hits = 0, untranslate_hits = 0
10 (NAS-Main) to (TWTC) source static GIt-SERVER NASMAIN-Public service SSH SS
H
translate_hits = 0, untranslate_hits = 0
11 (NAS-Main) to (TWTC) source static Terastation BTC-Email service SSH SSH
translate_hits = 0, untranslate_hits = 0
12 (NAS-Main) to (TWTC) source static ENGR-OpenVPN NASMAIN-Public service ENGR
-VPN-443 ENGR-VPN-443
translate_hits = 0, untranslate_hits = 0
13 (NAS-Main) to (TWTC) source static TS3000-Build NASMAIN-Public service TSbu
ild-4343-2 TSbuild-4343-2
translate_hits = 0, untranslate_hits = 0
14 (NAS-Main) to (TWTC) source static WEBAccess-FW interface service WEBAccess
-FW-Port-2 WEBAccess-FW-Port-2
translate_hits = 0, untranslate_hits = 0
15 (NAS-Main) to (TWTC) source static TestRail-private NASMAIN-Public service
TestRAil-80-2 TestRAil-80-2
translate_hits = 0, untranslate_hits = 0
16 (NAS-Main) to (TWTC) source static TS-WEbAccess-Test-private interface serv
ice Web-Access-Test-2 Web-Access-Test-2
translate_hits = 0, untranslate_hits = 0

Auto NAT Policies (Section 2)
1 (BTC) to (TWTC) source static BTC-ClearOS BTC-Public
translate_hits = 0, untranslate_hits = 1
2 (VideoConference) to (TWTC) source static VC VideoConferencePublic
translate_hits = 0, untranslate_hits = 2

Manual NAT Policies (Section 3)
1 (BTC) to (TWTC) source dynamic any interface
translate_hits = 0, untranslate_hits = 0
BAEng#

so from I can see from the

chris.hall6777 — Fri, 16 Oct 2015 20:35:22 GMT

so from I can see from the full config I have removed all my nat and acl commands, so I am wondering if I by chance deleted something extra while doing it.

ChrisIs the most important

Jon Marshall — Fri, 16 Oct 2015 20:51:53 GMT

Chris

Is the most important thing at the moment to get the users up and running rather than the server ?

If so, what interface does the internal traffic from the users come in on ?

Looking at your NAT statements did you add the first 3 lines ?

Do you know what they are for ?

It would help if you could post the full configuration and tell us what is the most important thing to get working.

Jon

Here is the full confignas

chris.hall6777 — Fri, 16 Oct 2015 21:03:14 GMT

Here is the full config

nas-main is the main group to get fixed

twtc is the outside interface

commands for https

I used the ADSM commands from this link

and added the https protcol

http://www.petenetlive.com/KB/Article/0000691.htm

ChrisIs general internet

Jon Marshall — Fri, 16 Oct 2015 21:08:52 GMT

Chris

Is general internet access for internal users on the NAS-Main interface the most important thing because I think we need a list of priorities.

If so then can you run from the CLI -

"packet-tracer input inside tcp 10.10.0.2 12345 8.8.8.8 80"

and post the results.

Or do you just want to try and fix the server in your initial request ?

Jon

the general internet access

chris.hall6777 — Fri, 16 Oct 2015 21:11:59 GMT

the general internet access for internal users is my main concern, the other I will deal with next week

Okay, can you run that

Jon Marshall — Fri, 16 Oct 2015 21:13:13 GMT

Okay, can you run that command and post the results here.

Jon

yes it was only related to

chris.hall6777 — Fri, 16 Oct 2015 21:13:18 GMT

yes it was only related to the server.

if you look at the link in the first reply with the full config. the comands are there,

it was a PAT with an acl for tcp/http/https

but I have since deleted that command

BAEng# packet-tracer input

chris.hall6777 — Fri, 16 Oct 2015 21:16:02 GMT

BAEng# packet-tracer input nas-main tcp 10.10.0.2 12345 8.8.8.8 80

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 TWTC

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: NAS-Main
input-status: up
input-line-status: up
output-interface: TWTC
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

BAEng#

Can you remove a line from

Jon Marshall — Fri, 16 Oct 2015 21:30:00 GMT

Can you remove a line from your configuration temporarily.

So type this -

"no access-group global_access global"

Then in this order -

1) run "sh nat" and save the output

2) run the same packet-tracer command as before

3) run "sh nat" again

post results.

Jon

am getting an error message

chris.hall6777 — Fri, 16 Oct 2015 21:32:48 GMT

am getting an error message on the command

no access-group global_access global

it is putting a marker at the a in the first access

Not sure why, it's in your

Jon Marshall — Fri, 16 Oct 2015 21:37:10 GMT

Not sure why, it's in your configuration.

Can you post output of "sh run access-group".

Jon

got it I had to do config t

chris.hall6777 — Fri, 16 Oct 2015 21:38:50 GMT

got it I had to do config t first

but now run sh nat is not working.

I am at the enable level

At the enable mode it should

Jon Marshall — Fri, 16 Oct 2015 21:41:11 GMT

At the enable mode it should just be "sh nat".

Jon