topic Issue with dynamic ports on 5510 in Network Security

Issue with dynamic ports on 5510

skirkpatrick1979 — Tue, 12 Mar 2019 01:34:23 GMT

I have a network administrator that has utilized RDP through our ASA to his webserver for administration. It worked perfectly until today. Now, his connectivity is coming in from TCP source ports above 60000 to 3389. The connectivity is being denied on the ASA. I tried setting a source range of >1024, then >49151 and neither of those worked. Does anyone have any thoughts on a way to get this traffic to pass?

Thanks

Sean

Issue with dynamic ports on 5510

Jouni Forss — Wed, 24 Apr 2013 20:42:20 GMT

Hi,

Never seen that the source port would have any effect on getting a connection coming through.

Can you please share the ASA configurations so they can be gone through.

Also you can take "packet-tracer" command output of the simulated connection

packet-tracer intput outside tcp

This should tell what rules the connections hit.

- Jouni

Issue with dynamic ports on 5510

skirkpatrick1979 — Wed, 24 Apr 2013 21:17:16 GMT

I can't share the config. I have a service group set up with 3389 and many other Windows ports in it. All the other ports are working fine. Just RDP is not. So, I know the config is good because the other ports are working.

Re: Issue with dynamic ports on 5510

Jouni Forss — Wed, 24 Apr 2013 21:28:07 GMT

Hi,

There is not much we can do if we cant get any output of the commands, log messages or any configurations related to the ASA.

Basicly you usually configure the NAT for the server with Static NAT or Static PAT

The source port of the connections shouldnt have nothing to do with the connection forming and the source port usually isnt limited but the destination port is.

Can you share any logs messages or the "packet-tracer" command output for the connection attempt?

You can naturally configure traffic capture on the ASA itself to see if the server is replying to the connection attempts at all but I got the picture that the ASA is blocking the connection?

- Jouni

Issue with dynamic ports on 5510

skirkpatrick1979 — Wed, 24 Apr 2013 21:35:41 GMT

Unfortunately, I can't share them. We are trying to connect from our production network to a webserver in the DMZ, and NAT/PAT are not needed. I had the administrator reboot his machine and it reset the connection. That started the source ports at a lower number, and now the RDP connection is working.