topic ASA 8.4 access list dynamic interface in Network Security https://community.cisco.com/t5/network-security/asa-8-4-access-list-dynamic-interface/m-p/2198217#M360375 <P>This is a working example using static. But it doesn't work with the dynamic interface or I'm doing something wrong. Need to get rdp access to my laptop.</P><P></P><P>-----------------------------------------------------------------------------------------------------</P><P></P><P>ASA Version 8.4(5)6 </P><P>!</P><P>hostname ciscoasa</P><P>enable password 8Ry2YjIyt7RRXU24 encrypted</P><P>passwd 2KFQnbNIdI.2KYOU encrypted</P><P>names</P><P>!</P><P>interface Ethernet0/0</P><P> switchport access vlan 2</P><P>!</P><P>interface Ethernet0/1</P><P>!</P><P>interface Ethernet0/2</P><P>!</P><P>interface Ethernet0/3</P><P> shutdown</P><P>!</P><P>interface Ethernet0/4</P><P> shutdown</P><P>!</P><P>interface Ethernet0/5</P><P> shutdown</P><P>!</P><P>interface Ethernet0/6</P><P> shutdown</P><P>!</P><P>interface Ethernet0/7</P><P> shutdown</P><P>!</P><P>interface Vlan1</P><P> nameif inside</P><P> security-level 100</P><P> ip address 10.0.0.1 255.255.255.0 </P><P>!</P><P>interface Vlan2</P><P> nameif outside</P><P> security-level 0</P><P> ip address dhcp setroute </P><P>!</P><P>object network obj_any</P><P> subnet 10.0.0.0 255.255.255.0</P><P>object network terminal-outside</P><P> host 68.216.158.109</P><P>object network terminal-inside</P><P> host 10.0.0.200</P><P>access-list incoming extended permit tcp any object terminal-inside eq 3389 </P><P>!</P><P>object network obj_any</P><P> nat (inside,outside) dynamic interface</P><P>object network terminal-inside</P><P> nat (inside,outside) static interface service tcp 3389 3389 </P><P>access-group incoming in interface outside</P><P></P><P> ------------------------------------------------------------------------------------------------------------------------------------------------</P> Tue, 12 Mar 2019 01:13:17 GMT dave love 2019-03-12T01:13:17Z ASA 8.4 access list dynamic interface https://community.cisco.com/t5/network-security/asa-8-4-access-list-dynamic-interface/m-p/2198217#M360375 <P>This is a working example using static. But it doesn't work with the dynamic interface or I'm doing something wrong. Need to get rdp access to my laptop.</P><P></P><P>-----------------------------------------------------------------------------------------------------</P><P></P><P>ASA Version 8.4(5)6 </P><P>!</P><P>hostname ciscoasa</P><P>enable password 8Ry2YjIyt7RRXU24 encrypted</P><P>passwd 2KFQnbNIdI.2KYOU encrypted</P><P>names</P><P>!</P><P>interface Ethernet0/0</P><P> switchport access vlan 2</P><P>!</P><P>interface Ethernet0/1</P><P>!</P><P>interface Ethernet0/2</P><P>!</P><P>interface Ethernet0/3</P><P> shutdown</P><P>!</P><P>interface Ethernet0/4</P><P> shutdown</P><P>!</P><P>interface Ethernet0/5</P><P> shutdown</P><P>!</P><P>interface Ethernet0/6</P><P> shutdown</P><P>!</P><P>interface Ethernet0/7</P><P> shutdown</P><P>!</P><P>interface Vlan1</P><P> nameif inside</P><P> security-level 100</P><P> ip address 10.0.0.1 255.255.255.0 </P><P>!</P><P>interface Vlan2</P><P> nameif outside</P><P> security-level 0</P><P> ip address dhcp setroute </P><P>!</P><P>object network obj_any</P><P> subnet 10.0.0.0 255.255.255.0</P><P>object network terminal-outside</P><P> host 68.216.158.109</P><P>object network terminal-inside</P><P> host 10.0.0.200</P><P>access-list incoming extended permit tcp any object terminal-inside eq 3389 </P><P>!</P><P>object network obj_any</P><P> nat (inside,outside) dynamic interface</P><P>object network terminal-inside</P><P> nat (inside,outside) static interface service tcp 3389 3389 </P><P>access-group incoming in interface outside</P><P></P><P> ------------------------------------------------------------------------------------------------------------------------------------------------</P> Tue, 12 Mar 2019 01:13:17 GMT https://community.cisco.com/t5/network-security/asa-8-4-access-list-dynamic-interface/m-p/2198217#M360375 dave love 2019-03-12T01:13:17Z ASA 8.4 access list dynamic interface https://community.cisco.com/t5/network-security/asa-8-4-access-list-dynamic-interface/m-p/2198218#M360377 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>You use Dynamic NAT / PAT for users traffic to Internet</P><P></P><P>Static NAT / PAT is used to enable hosting services from your LAN to the Internet</P><P></P><P><STRONG>object network terminal-inside</STRONG></P><P><STRONG>host 10.0.0.200</STRONG></P><P><STRONG> nat (inside,outside) static interface service tcp 3389 3389 </STRONG></P><P></P><P><STRONG>access-list incoming extended permit tcp any object terminal-inside eq 3389 </STRONG></P><P></P><P><STRONG>access-group incoming in interface outside</STRONG></P><P></P><P>The above configurations you have should enable you to access the LAN host from Internet using the "outside" interface public IP address.</P><P></P><P>- Jouni</P></BODY></HTML> Tue, 12 Mar 2013 15:55:54 GMT https://community.cisco.com/t5/network-security/asa-8-4-access-list-dynamic-interface/m-p/2198218#M360377 Jouni Forss 2013-03-12T15:55:54Z