Asa 5505 access rules & nat config

[Icharus83]

Hello,

i have an server on our DMZ where i want to allow a certain public ip's to access for example SQL and windows network drives, but also on that same internal server i have a iis running on port 90 where i want to allow everyone on the web.

I though if i add an rule (Access from any to "Inside host" and define port 90) and after that there is second rule where i define source ip's and other allowed ports (sql and  139,445 for network shares), but it is not working. I don't want to let everyone to my sql and windows shares..

How should this be done or is it even possible?

[Jouni Forss]

Hi,

• What software is the ASA running on?
• Does the DMZ server have its own public IP address or will you be doing the NAT with port forwarding using the outside interface public IP address?

- Jouni

[Icharus83]

Asa 8.43

I'm doing nat with port forwarding

[Jouni Forss · Accepted solution]

Hi,

I would have the Port Forward and ACL configurations in the following way (names and IPs used ofcourse will differ from your situation)

object network PORTFORWARD-TCP90

host 10.10.10.10

nat (dmz,outside) static interface service tcp 90 90

object network PORTFORWARD-TCP139

host 10.10.10.10

nat (dmz,outside) static interface service tcp 139 139

object network PORTFORWARD-TCP445

host 10.10.10.10

nat (dmz,outside) static interface service tcp 445 445

object network PORTFORWARD-TCP1433

host 10.10.10.10

nat (dmz,outside) static interface service tcp 1433 1433

access-list OUTSIDE-IN remark Allow TCP/90 from anywhere

access-list OUTSIDE-IN permit tcp any object PORTFORWARD-TCP90 eq 90

access-list OUTSIDE-IN remark Allow TCP/139/445/1433 only from certain IP address

access-list OUTSIDE-IN permit tcp host x.x.x.x object PORTFORWARD-TCP139 eq 139

access-list OUTSIDE-IN permit tcp host x.x.x.x object PORTFORWARD-TCP445 eq 445

access-list OUTSIDE-IN permit tcp host x.x.x.x object PORTFORWARD-TCP1433 eq 1433

access-list OUTSIDE-IN permit tcp x.x.x.x y.y.y.y object PORTFORWARD-TCP139 eq 139

access-list OUTSIDE-IN permit tcp x.x.x.x y.y.y.y object PORTFORWARD-TCP445 eq 445

access-list OUTSIDE-IN permit tcp x.x.x.x y.y.y.y object PORTFORWARD-TCP1433 eq 1433

access-group OUTSIDE-IN in interface outside

Not the cleanest configuration on the access-list side but should work. The access-list will first allow TCP/90 connections from anywhere. The following lines are examples of opening the other ports from only specific IP addresses or network ranges.

EDIT: This access-list is meant to be attached on the OUTSIDE interface of the ASA for traffic thats coming in from the Internet.

Please rate if the above was helpfull or ask additional questions.

- Jouni

[Jouni Forss]

EDIT: added the keyword "tcp" to the NAT configurations that was missing in the original post.

EDIT2: Edited some object names in the original ACLs that had typos