topic Re: Single Public IP on ASA Firewal in Network Security

Single Public IP on ASA Firewal

johnlloyd_13 — Fri, 21 Feb 2020 16:24:57 GMT

hi all,

i just need a quick confirmation. i got a site that will use ASA 5525-X to PAT internal users to internet and establish a site-to-site IPSec VPN to HQ using a single public IP address on the WAN/outside interface.

i usually get a /30 public WAN and /28 or /29 public LAN IPs but this time i just got a WAN IP.

my question, is it possible to use the single public IP for:

- PAT inside users

- build site-to-site IPSec VPN

-for port forwarding for the router behind the FW for remote access (from internet)

also, is my NAT statements/sequence correct? i.e. configure the static/port forwarding first, then the identity/"no NAT" for the internal subnet to VPN to HQ, last would be dynamic NAT/PAT using after-auto keyword.

object network OBJ-RT01 <<< PORT FORWARD TO ROUTER USING WAN/OUTSIDE IP
host 192.168.128.1
nat (inside,outside) static interface service tcp 22 22

object network OBJ-192.168.128.0 <<< "NO NAT" ON INTERNAL SUBNET TOWARDS HQ
subnet 192.168.128.0 255.255.255.0
nat (inside,outside) source static OBJ-192.168.128.0 OBJ-192.168.128.0 destination static OBJ-192.168.128.0 OBJ-192.168.128.0

object network OBJ-192.168.128.0 <<< DYNAMIC NAT/PAT INTERNAL USERS
subnet 192.168.128.0 255.255.255.0
nat (inside,outside) after-auto 1 source dynamic interface

Re: Single Public IP on ASA Firewal

Dennis Mink — Wed, 31 Oct 2018 02:59:38 GMT

yes strictly speaking this is possible, you can have your outside if (IP address respond to isakmp/ipsec/esp) to establish a tunnel. at the same time do a port forward on for instance 443 to an internal webserver. Then on the out, do an overload for internal to external browsing.

Re: Single Public IP on ASA Firewal

johnlloyd_13 — Wed, 31 Oct 2018 03:03:32 GMT

hi dennis,

thanks! i just made an edit to my question.

could you also confirm my NAT statements and sequence if they're correct?

Re: Single Public IP on ASA Firewal

gbekmezi-DD — Wed, 31 Oct 2018 03:05:45 GMT

A cursory look at your config samples look good.

Re: Single Public IP on ASA Firewal

Dennis Mink — Wed, 31 Oct 2018 03:14:53 GMT

They Look good to me, please note dont forget to open 80/443 to your internal IP address on the outside IF ingress ACL as well

Re: Single Public IP on ASA Firewal

johnlloyd_13 — Fri, 02 Nov 2018 06:58:56 GMT

hi,

just another quick question, i got a cisco router behind the ASA FW that i need to remote access:

router <> ASA <> internet

i already got SSH enabled on ASA 'outside' and able to SSH remotely, so my questions:

1) can i use telnet/TCP 23 to port forward to the router? or do i nee to use non common TCP ports, i.e. 2323

2) do i configure port forward as tcp 23 23 or tcp 23 2323?

object network OBJ-RT01
host 192.168.0.230 <<< ROUTER WAN IP
nat (inside,outside) static interface service tcp 23 23

object network OBJ-RT01
host 192.168.0.230
nat (inside,outside) static interface service tcp 2323 2323

2) do i need a static/identity NAT for the router's WAN IP (192.168.0.230)?

object network OBJ-192.168.0.230
host 192.168.0.230
nat (inside,outside) static OBJ-192.168.0.230

Re: Single Public IP on ASA Firewal

Dennis Mink — Fri, 02 Nov 2018 12:31:44 GMT

you can use any port, say 2323 and port forward that to the routers internal IP and tcp port 23. Now, opening it up external;ly is not recommended. so make sure you use strong passwords,

Re: Single Public IP on ASA Firewal

gbekmezi-DD — Fri, 02 Nov 2018 16:58:37 GMT

I’d add you don’t need to change the port the router uses for ssh to 23. You can continue to use 22 on the router for SSH. Create an access list on the ASA to only allow that ssh session from known sources.