topic Hi, I have only single public in Network Security

Cisco ASA 5512, IP NVR port forwarding

haider.rizwan — Tue, 12 Mar 2019 05:13:04 GMT

Hi,

i have Cisco 5512 ASA with version 8.6(1)2. i have one IP NVR for ip cameras.

please help me how to configure port forwarding in cisco asa in CLI?

I have static IP on ASA 94.56.178. 222 and NVR IP 10.192.192.100

thank you so much.

anyone?

haider.rizwan — Sat, 13 Dec 2014 08:51:30 GMT

anyone?

Hi Rizwan, NVR camera(INSIDE)

Rishabh Seth — Sat, 13 Dec 2014 11:16:35 GMT

Hi Rizwan,

NVR camera(INSIDE)-------[ASA]--------(OUTSIDE)

10.192.192.100 : PORT y 94.56.178.222 : PORT x

Scenario 1: If the IP 94.56.178. 222 is present on ASA outside interface:

Create object for NVR camera real IP:

object network NVR-IP
host 10.192.192.100
nat (inside,outside) static interface service tcp/udp <real-port-y > <mapped-port-x>

Scenario 2:If IP 94.56.178. 222 is not present on ASA outside interface then:

Create object for public IP and NVR-IP, then configure nat.

object network PUBLIC-IP
host 94.56.178.222

object network NVR-IP
host 10.192.192.100
nat (inside,outside) static PUBLIC-IP service tcp/udp <real-port-y > <mapped-port-x>

Change config as per your requirement .

Thanks,

Rishabh

Hi, I have only single public

haider.rizwan — Sat, 13 Dec 2014 11:21:15 GMT

Hi, I have only single public IP on ASA outside.

NVR is inside with private IP

please advise

Hi Rizwan,If you have camera

Rishabh Seth — Sat, 13 Dec 2014 11:23:49 GMT

Hi Rizwan,

If you have camera on inside then scenario 1 in my last reply should suffice your requirement.

Hi, I already have done same

haider.rizwan — Sat, 13 Dec 2014 11:37:09 GMT

Hi,

I already have done same config like scenario 1 but it's working.

object network obj-10.192.192.100
nat (INSIDE,OUTSIDE) static interface service tcp www 8814

>>Make sure that you have

Rishabh Seth — Sat, 13 Dec 2014 11:43:22 GMT

>>Make sure that you have access-list permitting traffic for NVR camera's private ip and tcp port 8814.

>>What is the packet tracer output for

packet-tracer input OUTSIDE tcp 2.2.2.2 12124 94.56.178.222 80 detailed

Can you paste the packet tracer output?

Phase: 1Type: ROUTE

haider.rizwan — Sat, 13 Dec 2014 11:59:05 GMT

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 94.56.178.122 255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2968e00, priority=0, domain=permit, deny=true
hits=184453, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=OUTSIDE, output_ifc=any

Result:
input-interface: OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Hi, Just to inform, in my NVR

haider.rizwan — Sat, 13 Dec 2014 12:14:54 GMT

Hi,

Just to inform, in my NVR TCP Port 5000 and HTTP Port 8814.

I wants to access NVR with http://WAN-IP:8814/

object network obj-10.192

Rishabh Seth — Sat, 13 Dec 2014 12:58:13 GMT

object network obj-10.192.192.100
nat (INSIDE,OUTSIDE) static interface service tcp 5000 8814

also configure access list to allow tcp 10.192.192.100 5000.

and run packet capture:

packet-tracer in OUTSIDE tcp 100.1.1.1 23542 94.56.178.222 8814 detailed

Phase: 1Type: ROUTE

haider.rizwan — Sat, 13 Dec 2014 13:55:32 GMT

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 94.56.178.122 255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2969000, priority=0, domain=permit, deny=true
hits=1148, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=OUTSIDE, output_ifc=any

Packet tracer output is

Rishabh Seth — Sat, 13 Dec 2014 17:19:26 GMT

Packet tracer output is showing acl drop because you have entered wrong destination IP in packet tracer command. Use 94.56.178.222 as destination IP.

If you try http://94.56.178.222:8814 then firewall will unat this traffic to 10.192.192.100:5000

Check if the nat works.

object network obj-10.192.192.100
nat (INSIDE,OUTSIDE) static interface service tcp 5000 8814

ASA# Phase: 1Type: ROUTE

haider.rizwan — Sun, 14 Dec 2014 07:33:36 GMT

ASA#

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 94.56.178.222 255.255.255.255 identity

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0x7fffa2969000, priority=0, domain=permit, deny=true

hits=11524, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=OUTSIDE, output_ifc=any

Result:

input-interface: OUTSIDE

input-status: up

input-line-status: up

output-interface: NP Identity Ifc

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

please advise

From the Packet tracer output

Rishabh Seth — Sun, 14 Dec 2014 09:27:29 GMT

From the Packet tracer output it looks like UN NAT is not taking place.

Paste your NAT statement here.

!object network obj-10.192

haider.rizwan — Sun, 14 Dec 2014 10:23:36 GMT

object network obj-10.192.192.100

host 10.192.192.100

object network obj-10.192.192.100

nat (INSIDE,OUTSIDE) static interface service tcp 5000 8814

what else i should do? I am totally confused.

thank you for helping

Hi Rizwan,Just to confirm

Rishabh Seth — Sun, 14 Dec 2014 12:25:36 GMT

Hi Rizwan,

Just to confirm requirement:

1. What is the IP on outside interface.

2. What is the port and and IP of nvr cam.

3. What is the mapped IP and port.

4. What is the packet tracer command which you are entering to test config.

Hi Rishabh,sorry, i was just

haider.rizwan — Sun, 14 Dec 2014 14:48:52 GMT

Hi Rishabh,

sorry, i was just hiding real IP address due to client restriction. 😞

here is the reply with real IP please help to resolve it.

Outside IP: 94.56.178.102

NVR IP: 10.171.192.10, HTTP port: 8814, TCP port: 5000, RTSP port: 554

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 94.56.178.102 255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2969000, priority=0, domain=permit, deny=true
hits=17629, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=OUTSIDE, output_ifc=any

Thank you so much

refer this article:https:/

Rishabh Seth — Sun, 14 Dec 2014 15:45:15 GMT

refer this article:

https://rowell.dionicio.net/configuring-nat-for-a-public-server-using-same-outside-interface/

you can try this,NVR IP: 10

Rishabh Seth — Mon, 15 Dec 2014 01:41:36 GMT

you can try this,

NVR IP: 10.171.192.10, HTTP port: 8814, TCP port: 5000, RTSP port: 554

object network NVR_IP
host 10.171.192.10

object service NVR-8814
service tcp destination eq 8814

object service NVR-5000
service tcp destination eq 5000

object service NVR-554
service tcp destination eq 554

nat (inside,outside) source static NVR_IP interface service NVR-8814 NVR-8814
nat (inside,outside) source static NVR_IP interface service NVR-5000 NVR-5000
nat (inside,outside) source static NVR_IP interface service NVR-554 NVR-554

Sir, No luck. it's not

haider.rizwan — Mon, 15 Dec 2014 06:52:30 GMT

Sir,

No luck. it's not working.

now i changed HTTP port to 54321 to test but both http ports (8814 & 54321) are not accessible. locally (LAN) i access NVR with http://10.171.192.10:54321 and it's fine in LAN.

any advise.