topic Re: ASA 9.9 Port forward problem in Network Security

ASA 9.9 Port forward problem

pwanderoy — Fri, 21 Feb 2020 15:46:30 GMT

I cannot get this to work.

What I want to do.

Host on Internet (any) --> FW (xx.xx.24.220:22) --> SSH-pi (10.10.50.65:22)

Host on internet connects with ssh to FW port tcp/22 and will then be forwarded to SSH-pi on port tcp/22.

interface GigabitEthernet1/1

nameif outside

security-level 0

ip address dhcp setroute (DHCP ip = xx.xx.24.220)

interface GigabitEthernet1/8.5

vlan 5

nameif FW-VL5

security-level 100

ip address 10.10.50.1 255.255.255.0

object network SSH-pi-ext-ip

host 77.53.24.220

object network SSH-pi

host 10.10.50.65

access-list outside_access_in extended permit tcp any object SSH-pi-ext-ip eq ssh log notifications

object network obj_any

nat (any,outside) dynamic interface

object network SSH-pi

nat (FW-VL5,outside) dynamic interface

access-group outside_access_in in interface outside

Re: ASA 9.9 Port forward problem

Florin Barhala — Wed, 16 May 2018 09:25:19 GMT

Couple things before we dive into your issue:

1. Update your original post and hide the public IP you're using for the object network SSH-pi-ext-ip

2. With ASA using port 22 on the outside interface it might happen that you cannot use it for a port-forward as you need. I am not 100% it's not possible, some tricks might help but I would just use any other external port like 2222 and map it to my internal server on port 22.

Here's PF config as I see it:

object network SSH-pi-ext-ip

host x.x.x.220

object network SSH-pi

host 10.10.50.65

object-group service ssh_2222 tcp

port-object eq 2222

object-group service ssh_22 tcp

port-object eq 22

nat (outside,inside) after-auto source static any any destination static SSH-pi-ext-ip object network SSH-p service ssh_2222 ssh_22 unidirectional

Re: ASA 9.9 Port forward problem

Dennis Mink — Wed, 16 May 2018 09:25:57 GMT

your NAT is wrong for port 22, you need to nat the outside ntercface on port 22 to inside pi 22, from outside to inside

Re: ASA 9.9 Port forward problem

Florin Barhala — Wed, 16 May 2018 09:34:36 GMT

Out of curiosity, what happens with this DNAT on 22 if the user adds:
ssh 0.0.0.0 0.0.0.0 outside