topic ASA 5505 DMZ config question - CLI in Network Security

ASA 5505 DMZ config question - CLI

kwhitley1 — Fri, 21 Feb 2020 09:47:13 GMT

I have recently inherited a network with an ASA 5505 at a remote office. Users there have a server that needs to be accessible from the outside. I would like to put this server in a DMZ and use port forwarding (I have the security plus license already installed). I can only find the ASDM instructions for this - there has to be CLI commands for this. Can someone please respond with either the instuctions or the link where I can find them?

Re: ASA 5505 DMZ config question - CLI

JORGE RODRIGUEZ — Mon, 12 Nov 2007 17:03:53 GMT

Will you be using the ASA outside interface IP? if so this thread should get you up and running for port forwarding , replace your static entry to reflect DMZ interface , static(DMZ,outside) etc.. , come back if any questions.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddfc9dc

Re: ASA 5505 DMZ config question - CLI

msosabar — Mon, 12 Nov 2007 17:32:09 GMT

Hello,

Here is an example of the configuration guide for PIX and ASA version 7.2, check it out and use for further reference.

Re: ASA 5505 DMZ config question - CLI

msosabar — Mon, 12 Nov 2007 17:33:08 GMT

Ups!!! sorry, here is the link:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/cfgnat.html#wp1043281

Re: ASA 5505 DMZ config question - CLI

kwhitley1 — Tue, 13 Nov 2007 02:59:33 GMT

First of all - thank you - both for your response.

Yes - the ASA outside interface IP will be used for the server as well.

Here is what I have created so far

An Object-group:

Object-group service SERVER tcp

description TCP Passthrough Ports

Port-object range XXXX-XXXX

Port-object range xxxx-xxxx

Port-object range eq xxxxx

An access list outside_access_in:

access-list outside_access_in extended permit tcp any host (outside IP) object-group SERVER

And applied this access list to the outside interface:

access-group outside_access_in in interface outside

Is this correct?

Would the static look like this?

static (DMZ,outside) (outside IP) (DMZ server IP) netmask 255.255.255.255

Do I need a global (outside) statement?

Re: ASA 5505 DMZ config question - CLI

JORGE RODRIGUEZ — Tue, 13 Nov 2007 13:24:28 GMT

your static should look as :

static (DMZ,outside) interface netmask 255.255.255.255

for global leave as is if Im not mistaken it should already have statement as " global (outside) 1 interface "

Re: ASA 5505 DMZ config question - CLI

kwhitley1 — Wed, 14 Nov 2007 23:23:13 GMT

This worked! Thank you much!

Re: ASA 5505 DMZ config question - CLI

kwhitley1 — Wed, 14 Nov 2007 23:23:58 GMT

Thank you - I have been looking for this without luck.