topic Yeah, that's what I'm in Network Security

ASA 9.0 Port forwarding

layne.peterson1 — Tue, 12 Mar 2019 05:49:50 GMT

I've got an ASA 5505 and I'm not very familiar with ASAs, let alone the 8.3+ release versions. I'm trying to set up some port forwarding, and using port 3389 just to test. I have this set up in the ASA:

object network PC_IP
nat (inside,outside) static interface service tcp 3389 3389

And these access-rules set up to allow it:

access-list outside_access_in extended permit object PC_T3389 any object PC_IP

After the first rule didn't work I tried this, without restricting IP at all.

access-list outside_access_in extended permit object PC_T3389 any any

When I actually test it or use Packet Tracer it doesn't work. Here is the output from Packet Tracer:

packet-tracer input outside tcp 66.236.77.178 61000 208.64.90.2 3389

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 208.64.90.2 255.255.255.255 identity

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Hi,This is a NAT

Vibhor Amrodia — Fri, 24 Apr 2015 05:04:05 GMT

Hi,

This is a NAT misconfiguration and i would request you to post the NAT commands from the ASA device .

Thanks and Regards,

Vibhor Amrodia

Yeah, that's what I'm

layne.peterson1 — Fri, 24 Apr 2015 16:21:38 GMT

Yeah, that's what I'm thinking as well. I played with it some more and I was able to get it to work using network object NAT, but at that point I can only forward one port to that network object. If I try to configure another port, it will overwrite the original with the new port.

nat (inside,outside) source static Inside_hosts NAT_NETWORK destination static REMOTE_NETWORK REMOTE_NETWORK
!
object network PC_IP
nat (any,outside) static interface service tcp 3389 3389
!
nat (any,any) after-auto source static VPN_USERS VPN_USERS destination static Inside_hosts Inside_hosts
nat (inside,outside) after-auto source dynamic Inside_hosts interface

I tried to forward UDP 69 and TCP 3389 and only one would work at a time. There has to be a way to forward multiple non-contiguous ports to the same host correct?

Hi,The only way is using the

Vibhor Amrodia — Sat, 25 Apr 2015 03:14:31 GMT

Hi,

The only way is using the Object NAT and use the Range Keyword for forwarding the contiguous ports.

There is no way to forward multiple dis contiguous ports on the ASA device.

Thanks and Regards,

Vibhor Amrodia