topic You are welcome, thank you in Network Security

Bridged Modem and ASA with Public IP

mahesh18 — Tue, 12 Mar 2019 04:04:13 GMT

Hi Everyone,

I am using two public IP for my home network via Bridged Modem

Setup

Router Switch Modem

ASA Switch Modem

Both Router and ASA have public IPs and are on separate network.

Outside interface of ASA has no ACL to permit any traffic on port 443.

When i connect from Network behind Router via https//ASA public IP anyconnect works fine

Need to know how connection on port 443 of outside interface of ASA is working without permit ACL?

Regards

Mahesh

From what I understand, ACL

Rudy Sanjoko — Mon, 14 Apr 2014 15:14:15 GMT

From what I understand, ACL on ASA outside interface is normally used to allow traffic going through the ASA, from lower to higher security level not to the ASA itself. If you try to access port 443 on a device behind the ASA, I believe it will be denied if you don't have the ACL configured.

The reason that you can connect to ASA on port 443 probably is because you have http and http server enable commands configured on the ASA.

Hi Rudy, Yes i have http

mahesh18 — Tue, 15 Apr 2014 00:06:39 GMT

Hi Rudy,

Yes i have http server configured so that i can access ir from outside.

Also when i use VPN ipsec client i am able to connect on port TCP 10000 even though ASA outside

interface is not allowing anything?

Regards

MAhesh

Hi, when you say that you are

Rudy Sanjoko — Tue, 15 Apr 2014 07:49:33 GMT

Hi, when you say that you are able to connect on port 10000, do you mean you can connect to ASA or to a device behind ASA? And is this after you successfully connected via VPN?

Hi Rudy, When i say i

mahesh18 — Tue, 15 Apr 2014 12:42:31 GMT

Hi Rudy,

When i say i connect via VPN IPSEC client i mean i connect to ASA itself not to any device

behind ASA.

Also when i do sh conn on ASA it does not show any ports used by VPN IPSEC.

Regards

MAhesh

If you connect using AC VPN

Rudy Sanjoko — Wed, 16 Apr 2014 11:13:09 GMT

If you connect using AC VPN client, you are connecting to port 443 as AC VPN client is using SSL for connection. Here is an example:

ASA# show asp table socket

Protocol Socket Local Address Foreign Address State
---- <output omitted> ----
TCP 00268688 b.b.b.b:22 a.a.a.a:62640 ESTAB
SSL 00278f48 b.b.b.b:443 a.a.a.a:64909 ESTAB
SSL 0027e738 b.b.b.b:443 a.a.a.a:57641 ESTAB
SSL 00285998 b.b.b.b:443 a.a.a.a:61188 ESTAB
SSL 00291168 b.b.b.b:443 a.a.a.a:27885 ESTAB
SSL 002a1628 b.b.b.b:443 a.a.a.a:62408 ESTAB
ASA#
ASA# show conn all
6 in use, 224 most used
TCP outside a.a.a.a:64603 NP Identity Ifc b.b.b.b:443, idle 0:00:18, bytes 2958, flags UOB
TCP outside a.a.a.a:54098 NP Identity Ifc b.b.b.b:443, idle 0:00:30, bytes 9338, flags UOB
TCP outside a.a.a.a:37676 NP Identity Ifc b.b.b.b:443, idle 0:00:35, bytes 1609, flags UOB
TCP outside a.a.a.a:57829 NP Identity Ifc b.b.b.b:443, idle 0:00:35, bytes 1257, flags UOB
UDP outside a.a.a.a:23174 NP Identity Ifc b.b.b.b:4500, idle 0:01:37, bytes 453, flags -
TCP outside a.a.a.a:62640 NP Identity Ifc b.b.b.b:22, idle 0:00:00, bytes 59676, flags UOB

If you connect using old Cisco VPN client, you are connecting to port 500 as Cisco VPN client is using IPSEC for connection. Here is an example:

ASA# show conn all
3 in use, 224 most used
UDP outside a.a.a.a:15388 NP Identity Ifc b.b.b.b:4500, idle 0:00:13, bytes 2594, flags -
UDP outside a.a.a.a:54950 NP Identity Ifc b.b.b.b:500, idle 0:00:55, bytes 1317, flags -
TCP outside a.a.a.a:62640 NP Identity Ifc b.b.b.b:22, idle 0:00:00, bytes 106888, flags UOB

Above are standard default ports for VPN clients. So you shouldn't be connected to port 10000 on ASA unless you changed the default ports value.

HTH,

Hi Rudy, I got the same

mahesh18 — Wed, 16 Apr 2014 12:26:39 GMT

Hi Rudy,

I got the same output as per your reply.

So does this proves that when we do VPN or Anyconnect to ASA itself then

we do not need to open VPN ports on outside interface of ASA as that traffic

is destined for ASA itself right?

Best Regards

Mahesh

That's partially correct. You

Rudy Sanjoko — Wed, 16 Apr 2014 14:08:28 GMT

That's not correct. You do need to open the port for 443 and 500 on the ASA, otherwise AC or VPN Client will not be able to establish a connection to the ASA. But you are not opening them using ACL.

By configuring crypto ikev1 enable command, you enable port 500 on ASA as IKE is using port 500 to communicate. The same as AC, you use the webvpn command. The different is that you can also enable port 443 using http server enable command on the ASA.

Please rate helpful comments/answers.

So learn something new today

mahesh18 — Wed, 16 Apr 2014 15:32:11 GMT

So learn something new today.

Thanks for answering all the posts.

Best Regards

Mahesh

You are welcome, thank you

Rudy Sanjoko — Wed, 16 Apr 2014 15:37:13 GMT

You are welcome, thank you for the rates.