topic Re: Punching a hole.... in Network Security

Punching a hole....

ixholla69 — Mon, 11 Mar 2019 11:46:54 GMT

I need to punch a whole through this ASA to get port 25 and 443 traffic through can someone give me the command to do that?

Currently it's a mail server on the other side of an ASA. I have the following Static on the ASA.

static (inside,outside) tcp 216.110.x.22 smtp 172.16.200.4 smtp netmask 255.255.255.255

static (inside,outside) tcp 216.110.x.22 https 172.16.200.4 https netmask 255.255.255.255

I added a line similar that went from (Outsie,Inside) but that didn't work. There's also an ACL saying to allow anything from the Internet to hit those servers for 25 and 443 any help would be greatly appreaciate as they havent had mail in 3 days.

Re: Punching a hole....

JORGE RODRIGUEZ — Fri, 11 Jan 2008 21:01:34 GMT

Are you using outside interface IP address for your static translation? if so try.

static (inside,outside) tcp interface smtp 172.16.200.4 smtp netmask 255.255.255.255

static (inside,outside) tcp interface https 172.16.200.4 https netmask 255.255.255.255

then your access list should be applied to your outside interface

e.g

access-list outside_access_in extended permit tcp any host 216.110.x.22 eq smtp

access-list outside_access_in extended permit tcp any host 216.110.x.22 eq https

access-group outside_access_in in interface outside

Rgds

Jorge

Re: Punching a hole....

ixholla69 — Fri, 11 Jan 2008 21:38:15 GMT

Yeah that didn't seem to work 😕

Re: Punching a hole....

JORGE RODRIGUEZ — Fri, 11 Jan 2008 22:55:30 GMT

ok, then try

remove acl

no access-list outside_access_in extended permit tcp any host 216.110.x.22 eq smtp

no access-list outside_access_in extended permit tcp any host 216.110.x.22 eq https

re-enter acl

access-list outside_access_in extended permit tcp any interface outside smtp

access-list outside_access_in extended permit tcp any interface outside https

access-group outside_access_in in interface outside

Re: Punching a hole....

ixholla69 — Fri, 11 Jan 2008 23:47:42 GMT

I get a

access-list outside_access_in extended permit tcp any interface outside smtp

ERROR: % Invalid input detected at '^' marker.

Re: Punching a hole....

JORGE RODRIGUEZ — Sat, 12 Jan 2008 00:06:48 GMT

I do apologize , missed keyword eq . please try.

access-list outside_access_in extended permit tcp any interface outside eq smtp

access-list outside_access_in extended permit tcp any interface outside eq https

access-group outside_access_in in interface outside

Re: Punching a hole....

sbaddipu — Sat, 12 Jan 2008 00:10:48 GMT

If you are using MS Exchange servers, you need to disable fixup (or inspect) for smtp.

Satya

Re: Punching a hole....

ixholla69 — Sat, 12 Jan 2008 00:16:05 GMT

%ASA-4-106023: Deny tcp src outside:24.20.x.93/1599 dst outside:216.110.x.22/25 by access-g roup "outside_access_in"

Re: Punching a hole....

ixholla69 — Sat, 12 Jan 2008 00:56:14 GMT

I wonder why that destination's showing up as Outside when it's coming in to an inside network ?