topic Re: CLI command to open ports 80, 443 and 1882 in Network Security

CLI command to open ports 80, 443 and 1882

PricingKernel — Mon, 11 Mar 2019 23:46:10 GMT

I need top open ports 80, 443 and 1882 to a specific external client (IP address). Can someone help me with the commands for that please?

Re: CLI command to open ports 80, 443 and 1882

Samuel Petrescu — Fri, 24 Aug 2012 15:48:14 GMT

If the client has public IP 123.123.123.123 and the server is located inside network and has the IP 10.10.10.10
This is the config, if you are using ASA

!
object network CLIENT-OBJ
description --- The client ----
host 123.123.123.123
!

object network SERVER-OBJ
     description --- The inside server ----
     host 10.10.10.10
     nat (inside,outside) static CLIENT-OBJ
!

object-group service SERVICES-TCP-OBJ tcp
     description --- Serices TCP published ----
     port-object eq 80
     port-object eq 443
     port-object eq 1882
!
!
!
access-list OUTSIDE-IN-ACL extended permit tcp object CLIENT-OBJ object SERVER-OBJ object-group SERVICES-TCP-OBJ

access-group OUTSIDE-IN-ACL in interface outside
!

Samuel Petrescu

Re: CLI command to open ports 80, 443 and 1882

PricingKernel — Fri, 24 Aug 2012 16:02:52 GMT

Thanks. Is the host IP my external IP or the internal IP of a particular client? I need to do this to permit VoIP traffic to some tablets that are connected wirelessly to the internal network and have IPs dynamically assigned by DHCP.

Re: CLI command to open ports 80, 443 and 1882

Samuel Petrescu — Fri, 24 Aug 2012 16:14:48 GMT

You need to be more specific

No, this config, allow the client outside network with public IP 123.123.123.123 to access a host inside your network that has private IP 10.10.10.10 on the ports TCP 80,443,1882

Re: CLI command to open ports 80, 443 and 1882

PricingKernel — Fri, 24 Aug 2012 16:18:39 GMT

Sorry about that. So is it possible to open those ports up to the whole range of DHCP assigned IPs as I described?

Re: CLI command to open ports 80, 443 and 1882

Samuel Petrescu — Fri, 24 Aug 2012 16:44:22 GMT

If the traffic is initiated from outside (internet) to your tablets, inside your network :

This require mappings public-IP -> private-IP one to one

You need to have one public IP for each tabled.

If the problem is in backwards, tablets from inside are trying to access an outside public IP, to specific ports, this is easy and possible.

Re: CLI command to open ports 80, 443 and 1882

Julio Carvajal — Fri, 24 Aug 2012 17:00:45 GMT

Hello Joel,

It is possible but you will need to configure some nat rules and ACL's permitting that traffic just as Samuel showed you

Regards,

Julio

Re: CLI command to open ports 80, 443 and 1882

PricingKernel — Sat, 25 Aug 2012 11:40:44 GMT

OK, I think the first suggestion may have been almost correct then, thanks. But if I wanted to add more than one internal host (in fact all in the range 192.168.1.100 to 149) is there a way to do that or will I have to create 50 object network SERVER-OBJ?

My wireless router is plugged into one port on the 819 ISR, my main router/firewall. Can I configure that port to have a narrower IP range and just add those to the solution?

For completeness my VoIP host is on an external IP address xxx.xxx.xxx.xxx and I want to permit inbound and outbound traffic across ports 80, 443 and 1882 to any tablet on the internal subnet 192.168.1.aaa to bbb. Hope this is clearer now and thanks to everyone who has helped so far.

Re: CLI command to open ports 80, 443 and 1882

PricingKernel — Tue, 28 Aug 2012 07:25:34 GMT

hi,

I tried entering the script suggested by Samuel. Unfortunately the command "nat" after object network SERVER-OBJ is not recognised by my CLI. These are the only supported commands:

Network object group configuration commands:

A.B.C.D Network address of the group members

any Any host

description Network object group description

exit Exit from IP policy-group configuration mode

group-object Nested object group

host Host address of the object-group member

no Negate or set default values of a command

range Match only packets in the range of IP address