topic Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4 in Network Security

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

RalphSmithIII — Tue, 12 Mar 2019 00:27:48 GMT

Hi everyone,

I am very new to configuring the ASA particulary after the change to how NAT is implemented. What I am trying to accomplish logically seems fairly simple, yet I cannot get it to work. I have a Synology NAS at home that I am trying to reach via the internet. Prior to using my ASA, I had Verizon's FIOS router as my gateway and everything forwarded with no issues.

As much as I've researched I haven't had any luck. The ports I need forwarded or reachable via the internet are TCP port 80 and 5000.

I can also configure it via command line if that's the easier/preferred method.

Any help would be greatly appreciated!

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Sun, 25 Nov 2012 23:13:26 GMT

Hello Ralph,

Lets say internal NAS host is 192.168.12.2 and you will be using the outside public IP address to access it

object network NAS

host 192.168.12.2

object service 5000

service tcp source eq 5000

object service HTTP

service tcp source eq 80

nat (inside,outside) 1 source static NAS interface service 5000 5000

nat (inside,outside) 2 source static NAS interface service HTTP HTTP

access-list outside_in permit tcp any host 192.168.12.2 eq 5000

access-list outside_ in permit tcp any host 192.168.12.2 eq 80

access-group outside_in in interface outside

Remember to rate all of my posts ( How to? Mark The five stars at the bottom of my reply)

Regards,

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

RalphSmithIII — Mon, 26 Nov 2012 01:48:53 GMT

That did the trick! Love the internet and people willing to contribute their time and knowledge.

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Mon, 26 Nov 2012 02:17:47 GMT

Glad to know I could help

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

mxa2kat1k — Wed, 06 Mar 2013 06:18:30 GMT

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

I have the same issue. But You wrote your answer in console commands not like asdm 6.4

Can you please help me with asa...

The problem is:

Router d-link di824 (ip 192.168.100.1 255.255.255.0) have rules(Virtual Servers port forwarding) tcp ports 34000-34300 send to asa5505 (vlan2 ip 192.168.100.4 255.255.252.0). Connections to this router ports comes from outside (exmpl 81.30.199.4 and etc)

So, the question how to configure NAT or PAT to port forwarding this connections to another inside ip addresses.

For example: 34234 to local ip 192.168.100.152:34234

and next 34235 to local ip 192.168.100.23:34235

and next 34236 to local ip 192.168.100.133:34236

and so on.

It's have to have like 300 rules. or a littel bit less.

Thank you so much!

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Wed, 06 Mar 2013 06:40:41 GMT

Hello Kirill,

object service tcp-34234

service tcp source eq 34234

object network Internal-server1

host 192.168.100.152

nat (inside,outside) source static Internal-server1 interface service tcp-34234 tcp-34234

Those would be the commands for the nat rules

Re: Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

mxa2kat1k — Wed, 13 Mar 2013 12:02:51 GMT

Thank you jcarvaja!

But it doesn't work for me exactly.

Propably you forget something, or i don't understand it right way.

Router dlink(192.168.100.1 have global inside ip 92.52.142.86 from ISP it is static)

Clients from public network have to connect to it using this ip (92.50.142.86 and specific tcp port 34601 and so on)

Router has connections to local PCs with ip's 192.168.100.23, 192.168.100.152 etc.

On this PCs running servers with ports 192.168.100.23:34601-34605, 192.168.100.152:34601-34605.

ASA has 2 interfaces: 1 inside (1-7 ports) and 2 outside (0 port)

inside: 192.168.100.4/24

outside: 192.168.0.4/24

Router Dlink connected with cisco from switch. Router lan port to switch and cisco interface inside with switch

Local PCs connected through switch as well.

Do I have to use outside interface (0 port) ?

You wrote this rule:

nat (inside,outside) source static Internal-server1 interface service tcp-34234 tcp-34234

Why it goes with outside "word"?

I did it and tryed packet tracet and it shows that everything is good.

But still there is no connections.

I even don't know how to monitor everithing..... )

Please help )

If I change virtual servers in Router dlink to connect straight to PCs it works. But only I cant write such number of rules. It allows me to write 23 rules lets say any 34605 to 192.168.100.23:34605 any 34606 to 192.168.100.152:34606. But it will be only 23 rules.

If I tryed to write only one rule any tcp 34600-34900 to asa5505 (192.168.100.4:34600-34900) but asa don't undarstand where to send it forward

Re: Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

mxa2kat1k — Tue, 19 Mar 2013 05:55:50 GMT

still don't have a solution. Please help!

What i did.

Local PC lenovo (192.168.12.5) which is waiting connection from internet located in inside interface (192.168.12.4)

Also ASA has outside interface (192.168.100.4).

Routed dlink 192.168.100.1 has virtual server to port forwarding to 192.168.100.4 (ASAs outside interface)

ASA have to port it forward as well to 192.168.12.5 coz it has nat rules

and it still don't work!

Please any suggestions?

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Tue, 19 Mar 2013 16:06:32 GMT

Hello Kirill,

Lets start from zero

So you are doing NAT on two parts.. your ASA and the Outside Router.....

On what port do you want to connect from the outside interface?

You will use the outside interface IP address to do the NAT right?

Can you share the following

Show run NAT

And the show run objects for each of the objects that you have created for the nat.

Regards

Re: Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

mxa2kat1k — Wed, 20 Mar 2013 11:46:11 GMT

Result of the command: "show run object"

This part of objects:

object network lenovo

host 192.168.12.5

object network out

host 192.168.0.4

object service 34608

service tcp source eq 34608 destination eq 34608

Result of the command: "show run nat"

nat (inside,outside) source static lenovo interface service 34608 34608

Also:

Result of the command: "show run all"

: Saved

ASA Version 8.4(3)

interface Ethernet0/0

switchport access vlan 2

switchport mode access

no switchport protected

speed auto

duplex auto

delay 10

interface Ethernet0/1

switchport access vlan 1

switchport mode access

no switchport protected

speed auto

duplex auto

delay 10

On what port do you want to connect from the outside interface? 34608.

You will use the outside interface IP address to do the NAT right? What do You mean?

PC lenovo 192.168.0.5 located inside. He is waiting connection from outside.

Outside has only one port 0/0 Ethetnart and ip is 192.168.100.4 to this port cable going router 192.168.100.1

Thank you very much for helpong! You are only the person who can help!

Re: Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Wed, 20 Mar 2013 17:01:00 GMT

Hello,

Please change this:

object service 34608

no service tcp source eq 34608 destination eq 34608

service tcp source eq 34608

leave it like that ,

do the following and share the output

packet-tracer input outside tcp 4.2.2.2 1025 192.168.0.4 34608

So just to confirm on the outside interface you are using the 192.168.0 range right?

Re: Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

mxa2kat1k — Mon, 25 Mar 2013 02:18:00 GMT

Thank You jcarvaja!

It's working now! You are Great!

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

dffdejesus — Mon, 25 Nov 2013 03:05:27 GMT

Hi all,

please kindly help me on my issue

all I want to perform is all http port ( port 80 ) going to our public IP 210.4.104.xx will port

forward to our web server 10.0.1.155

and all port 39393 ( port that I created ) going to our public IP 210.4.104.xx will port

forward to 10.0.1.155:39393

I really appreciate you help

thanks

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Mon, 25 Nov 2013 04:51:16 GMT

Hello Dexter,

What OS version are you running?

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

dffdejesus — Mon, 25 Nov 2013 04:57:50 GMT

Hi Jcarvaja,

thanks for the reply my OS version is 8.4(2 )

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Mon, 25 Nov 2013 05:02:52 GMT

Hello Dexter,

all I want to perform is all http port ( port 80 ) going to our public IP 210.4.104.xx will port

forward to our web server 10.0.1.155

and all port 39393 ( port that I created ) going to our public IP 210.4.104.xx will port

forward to 10.0.1.155:39393

object network Host-A

host 10.0.1.155

Object Network Outside_IP

host 210.4.104.xx

Object Service TCP_HTTP

service tcp source eq 80

object Service tcp_PORT2

service tcp source eq 39393

nat (inside,outside) source static Host-A Outside_IP service TCP_HTTP TCP_HTTP

nat (inside,outside) source static Host-A Outside_IP service tcp_PORT2 tcp_PORT2

access-list out_in permit tcp any host 10.0.1.155 eq 80

access-list out_in permit tcp any host 10.0.1.155 eq 39393

access-group out_in in interface outside

That's it buddy As a thanks you can visit my webiste and make sure you talk about it with your friends hehe

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

dffdejesus — Mon, 25 Nov 2013 05:12:40 GMT

Thank for the Post..I will give it a try later and will update you..

I always visit your site, and its very helpful

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Mon, 25 Nov 2013 05:14:47 GMT

Hello Dexter,

No problem my pleasure to help.

And it's always great to hear that kind of information

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

dffdejesus — Mon, 25 Nov 2013 06:25:00 GMT

Hi Jcarvaja,

receiving error:

Error: Address 210.4.104.xx overlaps with outside interface address

Error: Nat Policy is not downloaded

thanks

Regards,

Dexter

Basic Port Forwarding ASA5505 Verion 8.4 ASDM 6.4

Julio Carvajal — Mon, 25 Nov 2013 06:26:57 GMT

Hello,

if you are using the Outside interface IP address then use:

nat (inside,outside) source static Host-A interface service TCP_HTTP TCP_HTTP

nat (inside,outside) source static Host-A interface service tcp_PORT2 tcp_PORT2

Interface is a keyword recognized by the ASA that lets you know you want to use the Outside IP address for the NAT

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com