topic ASA Port Forwarding - 8.3 in Network Security

ASA Port Forwarding - 8.3

martynch1 — Fri, 21 Feb 2020 16:34:39 GMT

Good morning all, I'm trying to create a rule on my ASA that will allow the outside to a www on the inside of my network but not having much luck

Dec 15 2018

11:06:15

106023

213.205.192.21

33112

192.168.6.245

Deny tcp src outside:213.205.192.xx/33112 dst inside:192.168.6.245/80 by access-group "global_access" [0x0, 0x0]

I have created the following:

object network AD-Conrtoller
host 192.168.6.245
description AD-Conrtoller

object service www-80
service tcp source eq www
description www-80

access-list inside_access_in extended permit tcp any object AD-Controller eq www

show nat
Manual NAT Policies (Section 1)
1 (inside) to (outside) source static AD-Controller interface service any www-80
translate_hits = 2, untranslate_hits = 225

What is the issue with the above?

Thank you

Re: ASA Port Forwarding - 8.3

Sheraz.Salim — Sun, 16 Dec 2018 09:44:37 GMT

put this command and try and let us know

access-group inside_access_in in interface outside

you can also do a command

packet-tracer input outside tcp 8.8.8.8 1234 192.168.6.245 80 detail

than please share the output. this command will tell you where the problem is.

Re: ASA Port Forwarding - 8.3

Rob Ingram — Sat, 15 Dec 2018 16:20:29 GMT

Hi,
Your nat configuration appears incorrect. In your object "www-80" you are specifying the source port is tcp/80, but as your logs indicate the traffic source port is 33112.

You would be sending traffic to destination of tcp/80, the tcp source port would be random. This example configuration should help:-

object network AD-Conrtoller
host 192.168.6.245
nat (INSIDE,OUTSIDE) static interface service tcp www www

HTH

Re: ASA Port Forwarding - 8.3

Sheraz.Salim — Sat, 15 Dec 2018 19:23:46 GMT

Hi RJI

there is still need for access-group command according to the given config

access-group inside_access_in in interface outside