allow external traffic to access internal computers

[par13]

We have an ASA 5505 running version 8.4. We are having problems allowing external traffic to access computers behind the firewall. Our current config is:

ASA Version 8.4(3)
!
hostname ciscoasa
domain-name default.domain.invalid
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.2.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 152.18.75.132 255.255.255.240
!
boot system disk0:/asa843-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
object network a-152.18.75.133
host 152.18.75.133
object network a-10.2.1.2
host 10.2.1.2
object-group network ext-servers
network-object host 142.21.53.249
network-object host 142.21.53.251
network-object host 142.21.53.195
object-group network ecomm_servers
network-object 142.21.53.236 255.255.255.255
object-group network internal_subnet
network-object 10.2.1.0 255.255.255.0
access-list extended extended permit ip any any
access-list extended extended permit icmp any any
access-list extended extended permit ip any object-group ext-servers
access-list acl_out extended permit tcp any object-group ecomm_servers eq https
access-list outside_in extended permit ip any host 10.2.1.2
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply inside
icmp permit 10.2.1.0 255.255.255.0 inside
icmp permit any echo-reply outside
icmp permit any outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static a-10.2.1.2 a-152.18.75.133
route outside 0.0.0.0 0.0.0.0 152.18.75.129 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.2.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh 10.2.1.2 255.255.255.255 inside
ssh 122.31.53.0 255.255.255.0 outside
ssh 122.28.75.128 255.255.255.240 outside
ssh timeout 30
console timeout 0

dhcpd auto_config outside
!
dhcpd address 10.2.1.2-10.2.1.254 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:c7d7009a051cb0647b402f4acb9a3915
: end

ciscoasa(config)# sh nat
Manual NAT Policies (Section 1)
1 (inside) to (outside) source static a-10.2.1.2 a-152.18.75.133
    translate_hits = 1, untranslate_hits = 112
ciscoasa(config)# sh nat
Manual NAT Policies (Section 1)
1 (inside) to (outside) source static a-10.2.1.2 a-152.18.75.133
    translate_hits = 1, untranslate_hits = 113
ciscoasa(config)#

[patrick.preuss]

Hi

can you please explain what host you whant to reach?

from my point try

static (Inside,Outside) 10.2.1.2 152.18.75.133 netmask 255.255.255.255

HTH

[par13]

This command static (inside, outside) works on previous firewall version. But, in version 8.4 it does not work. In the previous version 7.2, I could use the command that you are suggesting. I am not sure what change on 8.4 that any of this commands works any longer. Bottom line, I need to allow external traffic to access a computer behind the firewall using any port.

Thanks

[patrick.preuss]

Hi Par

i see. Ok do the router know where to place the packets for you inside host ?

if i am right you must have something like an alias on the outside, so you route can finde the 133.

Patrick

Message was edited by: Patrick Marc Preuss

[par13]

yes, my inside computers are able to access the internet,etc. But, external traffic cannot access the computers beging the firewall.

[patrick.preuss]

yes inside to out is not the problem,

knows the outside router where to place packets for 133 ??

[par13]

I have two issues, and you can help to decide here. First, the firewall outside interface ip is 132 which knows how to get to the gateway. Second, in the previous version 7.3, a technician asked me to create a static address 133 which could be used for outside traffic coming thru the firewall and behind the firewall. If you take a look at the configuration info provided on my first discussion submission, it shows the static address. However, the firewall does not seem to recognise this static address. I cannot ping the 133 only the 132. So, perhaps, my hold issue is that until the 133 is recognized by the firewall.

[patrick.preuss]

hi par

think you need somthing like global (outside) 152.18.75.133

[par13]

Thanks

But, the global command is not recognized any longer in version 8.4

[llamaw0rksE]

Okay I will bite.

Assuming you have

a.  dynamic pat rule for lan users-devices to reach the internet

(missing ???????????????

(should look like a nat rule that makes two entries when you make the one rule)
(with router set at defaults it may make this rule for you already in place)

-object bit  

object network obj_any_inside
 subnet 0.0.0.0 0.0.0.0

and rule bit

object network obj_any_inside
 nat (inside,outside) dynamic interface

b.  route rule - tells asa next hop is IP gateway address

route outside 0.0.0.0 0.0.0.0 152.18.75.129 1

c.  Nat rule for port forwarding- Using objects it creates two entries (lets say i call it natforward4server)

object bit

object network natforward4server
 host 10.2.1.2

 Nat bit

object network natforward4server
 nat (inside,outside) static interface service tcp 443 443

 
 d. Nat for translated ort. 
If you had wanted to translate a port, lets say you have external users that can only use port 80 but need to access https 
 
object bit
object network natfortransl4server
 host 10.2.1.2

 Nat bit
object network natfortransl4server
 nat (inside,outside) static interface service tcp 443 80

 

[jack.leung]

The configuration looks correct. Is that the full config however? I don't see the ACL bound to your interface. Can you make sure this is in?

access-group outside_in in interface outside