topic Re: ASA port forwarding problem from port 222 to 22 in Network Security

ASA port forwarding problem from port 222 to 22

robinandjiang — Fri, 21 Feb 2020 17:28:57 GMT

the request is when the traffic hit the public IP on port 222, i need to redirect to a internal server on port 22.

mu configuration is like this:

object network FTP-Access
nat (dmz2,outside) static FTP-SVR-Public service tcp ssh 222

access-list global_access extended permit tcp any object FTP-Access eq 222

access-group global_access global

but it doesn't work.

please help.

thanks

Re: ASA port forwarding problem from port 222 to 22

Rob Ingram — Tue, 10 Sep 2019 19:13:51 GMT

Hi,
You need to reference the real port in the ACL, which would be 22.

HTH

Re: ASA port forwarding problem from port 222 to 22

robinandjiang — Tue, 10 Sep 2019 19:21:24 GMT

i tried both the ports in ACL, but didn't work, even no traffic hit the rule.

Re: ASA port forwarding problem from port 222 to 22

Rob Ingram — Tue, 10 Sep 2019 19:25:18 GMT

Is your static nat rule above the dynamic nat rule used for outbound access? Provide the output of "show nat" if unsure

Also run packet-tracer on the cli and provide the output

Re: ASA port forwarding problem from port 222 to 22

robinandjiang — Tue, 10 Sep 2019 19:46:11 GMT

the static nat is above the dynamic nat, we using different public IP for different port forwarding, and the PAT still go through the main public IP.

object network FTP-Access
nat (dmz2,outside) static FTP-SVR-Public service tcp ssh 222
!
nat (dmz2,outside) after-auto source dynamic any interface

Re: ASA port forwarding problem from port 222 to 22

Rob Ingram — Tue, 10 Sep 2019 19:51:19 GMT

Ok, fine. What about providing the output from packet-tracer for review?

Re: ASA port forwarding problem from port 222 to 22

robinandjiang — Tue, 10 Sep 2019 20:01:03 GMT

the configuration has been changed , because we decided to use the same port 22 and it works fine.

thanks for you help.

i will set up a lab to do more tests for this issue.

thanks