topic Re: Port Forwarding on cisco asa5505 in Network Security

Port Forwarding on cisco asa5505

Roberto Kippins — Tue, 12 Mar 2019 00:38:08 GMT

Hi I need help with doing a port forward for remote desktop with asa5505 9.1.1 and asdm 7.1.1 i could have done this with the previous versions of asdm but now it even more confusing

Re: Port Forwarding on cisco asa5505

Jouni Forss — Mon, 17 Dec 2012 17:35:03 GMT

Hi,

Basic command format (that you can also insert through the ASDM toolbar -> Command Line Interface)

object network STATIC-PAT

host 10.10.10.10

nat (inside,outside) static interface service tcp 3389 3389

access-list OUTSIDE-IN permit tcp any object STATIC-PAT eq 3389

Where

STATIC PAT = name of the object that holds the source host IP and the actual NAT command
host 10.10.10.10 = example LAN host IP to be Static PATed
nat (inside,outside) static interface service tcp 3389 3389 = does nat between "inside" and "outside" interface and uses the "outside" interface IP address. Forwards port TCP/3389 to port TCP/3389 of the LAN host IP
access-list OUTSIDE-IN permit tcp any object STATIC-PAT eq 3389
- access-list is attached to interface with command "access-group"
- access-group OUTSIDE-IN in interface outside

What was your last firewall version? Was it perhaps even below 8.3?

- Jouni

Port Forwarding on cisco asa5505

Roberto Kippins — Mon, 17 Dec 2012 17:38:25 GMT

my last version was 8.4 with asdm 6.1.3 and i could have done it in the blink of an eye with this asdm but now it is just confusing

Port Forwarding on cisco asa5505

Roberto Kippins — Mon, 17 Dec 2012 17:40:55 GMT

im new to cisco and the cli are there any gui examples with the new asdm

Re: Port Forwarding on cisco asa5505

Jouni Forss — Mon, 17 Dec 2012 17:44:28 GMT

Hi,

Are you saying the NAT configuration has somehow changed? I haven't tested 9.x software yet myself. Only 8.4(x)

Whats different from the below configuration windows? (using my own ASAs interface names)

Configuration -> Firewall -> NAT Rules -> Add Network Object

LAN = "inside"

WAN = "outside"

Advanced

- Jouni

Re: Port Forwarding on cisco asa5505

Roberto Kippins — Mon, 17 Dec 2012 18:04:43 GMT

ok i got this piece and what abt the access rule

Re: Port Forwarding on cisco asa5505

Jouni Forss — Mon, 17 Dec 2012 18:12:03 GMT

Hi,

Configuration -> Firewall -> Access Rules ->

Right Click on the Interface/ACL for your "outside" interface in the list you see and choose "Add Access Rule"

STATIC-PAT = name of the object created in the NAT configuration

Please rate if you found the information was helpfull. Also mark the question as answered (if it was).

- Jouni

Re: Port Forwarding on cisco asa5505

Roberto Kippins — Mon, 17 Dec 2012 18:38:11 GMT

ok thanks for your help bro but here is waht mine looks like

Re: Port Forwarding on cisco asa5505

Jouni Forss — Mon, 17 Dec 2012 18:46:25 GMT

Hi,

The first picture seems to be for me the configuration for a different type of NAT rule. Not the "Network Object" type of NAT

When you have gone to Configuration -> Firewall -> NAT Rules -> Then Right Click and the below options should be visible (This unless there has been some change from 8.4 -> 9.x)

The middle one highlighted for me gives the configuration window desired.

I guess if the ACL portion of the ASDM has changed because of some change in 9.x

I assume you can just add the rules by filling the above fields which are needed (source, destination, service)

To be honest, I dont personally use the ADSM for ACL and NAT so I'm a bit (if not alot) rusty with it.

- Jouni

Port Forwarding on cisco asa5505

bara.lucia — Wed, 06 Mar 2013 08:58:37 GMT

Hi Roberto,

Are you done with the configuration? its successfull or not? because i have this problem either.

- Bara

Re: Port Forwarding on cisco asa5505

Jouni Forss — Wed, 06 Mar 2013 09:53:25 GMT

Hi,

I went as far as changing my own ASA software from 8.4(5) to 9.1(1) and ASDM 7.1(1)52. I use the other software as there are some bugs related to NAT on the 9.1(1) software

I dont personally ever use ASDM for NAT and ACL configurations but here is how I would configure Port Forward / Static PAT through the ASDM

Go to Configuration -> Firewall -> NAT Rules -> Right Mouse Click to open the menu -> Choose Add "Network Object" NAT Rule

It will open the following window which you can configure in the following way

Where

PORT-FORWARD = Is the name of the Object that will contain the Real IP address of the host and the actual NAT configuration
10.0.0.100 = Is a example Real IP address
WAN = Is the "nameif" of my "outside" interface

Next click Advanced on the window, it will open the following window, where you can fill the port and interface information

Where

LAN = Is my "inside" interface
WAN = Is my "outside" interface
tcp = Is the protocol used (can be udp if you want/need)
1111 = Is the actual port on the LAN host
2222 = is the mapped port that is visible to the WAN

Finally Click Ok on all windows and then Apply

The ASDM will insert the configurations in CLI format to the ASA

object network PORT-FORWARD

host 10.0.0.100

nat (LAN,WAN) static interface service tcp 1111 2222

As you can see pretty simple configurations on the CLI instead of jumping between different windows and options on the ASDM.

Naturally you will need an ACL allowing this traffic also from the "outside" or "WAN" interface, whatever you are using.

You will need to open the traffic by using the REAL IP and REAL PORT

So for example the ACL rule allowing this traffic from Internet could look like this

access-list WAN-IN extended permit tcp host 1.1.1.1 object PORT-FORWARD eq 1111

Please rate if the information has been helpfull

- Jouni

Port Forwarding on cisco asa5505

Nickolay Krysenkov — Fri, 24 May 2013 09:07:19 GMT

Hi.

syslog

Teardown TCP connection 5735645 for outside:83.220.238.182/54731 to inside:10.2.150.5/3389 duration 0:00:30 bytes 0 SYN Timeout

What's the problem?

Port Forwarding on cisco asa5505

Jouni Forss — Fri, 24 May 2013 09:19:05 GMT

Hi,

The host 10.2.150.5 on the "inside" is not replying to the TCP Connection forming.

You should check that no local firewall on the host is blocking the connection and also check that the host is configured otherwise to allow RDP sessions to it.

Also if those are ok should confirm that the host on the "inside" has the default route back to the Internet through the ASA.

- Jouni

Port Forwarding on cisco asa5505

Nickolay Krysenkov — Fri, 24 May 2013 10:58:30 GMT

Here 1.1.1.1 wan ip address?

object network PORT-FORWARD

host 1.1.1.1

nat (lan,wan) static interface service tcp 3389 3389

access-list wan_access_in extended permit tcp any object PORT-FORWARD eq 3389

Re: Port Forwarding on cisco asa5505

Jouni Forss — Fri, 24 May 2013 11:05:54 GMT

Hi,

The IP address under the "object network" should be the local IP address of the host/server

The parameter "interface" in the "nat" configuration line specifies that the IP address of the interface "wan" will be used as the NAT IP address.

object network

host

nat (lan,wan) static interface service tcp

Remember to rate helpfull answers.

- Jouni

Port Forwarding on cisco asa5505

Nickolay Krysenkov — Fri, 24 May 2013 11:24:36 GMT

I am write

object network TEST

host

nat (LAN,WAN) static interface service tcp 3389 3389

access-list WAN_access_in extended permit tcp any object TEST eq 3389

Dont work.

Syslog

Teardown TCP connection 6306058 for disbacak:83.220.236.74/29128 to icbacak:10.2.150.5/3389 duration 0:00:30 bytes 0 SYN Timeout

What is he problem?

Port Forwarding on cisco asa5505

Jouni Forss — Fri, 24 May 2013 12:03:04 GMT

Hi,

The format for configuring Static PAT is pretty simple

You configure an "object network", for example

object network SERVER-RDP

host x.x.x.x

nat (lan,wan) static interface service tcp 3389 3389

The above "lan" and "wan" are interface names. If your interfaces are named different like they seem to be looking at the log message then you naturally use those.

The x.x.x.x means the local ip address configured on the actual host on your LAN network. Its not the public IP address.

- Jouni

Port Forwarding on cisco asa5505

Nickolay Krysenkov — Fri, 24 May 2013 12:11:00 GMT

I still did.

But when asked to external ip address in the logs an error

Teardown TCP connection 6306058 for disbacak:83.220.236.74/29128 to icbacak:10.2.150.5/3389 duration 0:00:30 bytes 0 SYN Timeout

What had I done?

Port Forwarding on cisco asa5505

Jouni Forss — Fri, 24 May 2013 12:13:38 GMT

Hi,

Seems to me that there is some translation already for IP address 10.2.150.5 local IP address and the connection that is taken through the firewall is allowed.

The actual target machine doesnt respond to the connection attempt.

This doesnt seem to be a problem with the firewall. It seems to be a problem with the PC you are trying to connect to.

- Jouni

Port Forwarding on cisco asa5505

Nickolay Krysenkov — Fri, 24 May 2013 12:18:43 GMT

If connected to the LAN by 10.2.150.5 RDP, the connection is established.

When you connect the external IP an error.