Port Forwarding in ASDM7.1

[AlekseyAndrosov]

Hi all,

I can't make the port forwarding on ASA work.

Internal Resouce IP: AA

ASA Public Interface IP: BB

Real port: 443

Mapped port: 4444

External hosts, for whom Access Must be allowed: CC

I configured Static NAT: BB:4444 -> AA:443

And ACL: permit CC -> BB:4444

Live test negative, and packet tracer shows "blocked by ACL".

In packet tracer, I enter Source Addr CC, Source Port 1000, Dest Addr BB, Dest Port 4444

Any suggestions very welcome !

[Henrik Grankvist · Accepted solution]

Hi

Post your CLI configuration instead.

Should be something similar to (if you are using auto NAT):

object network INTERNAL_RESOURCE_IP
 host 192.168.1.50
 nat (INSIDE,OUTSIDE) static interface service tcp 443 4444

access-list OUTSIDE_IN permit tcp any object INTERNAL_IP 443
access-group OUTSIDE_IN in interface OUTSIDE

[AlekseyAndrosov]

@Henrik,

Thanks for your quick answer.

If my external clients need to access Public IP on port 4444, and the Dest. IP in this packet must be translated to INTERNAL_IP port 443, shouldn't I reverse 443 and 4444 in your proposed configuration ?

[Henrik Grankvist]

No, it should be as I wrote it.

[AlekseyAndrosov]

Thanks, it worked.

There's 1 more thing though, not mentioned in your post, and not mentioned in ASA config guides (either ASDM or CLI).

There must be 2 ACLs on the Outside interface.

1 to mapped Address:Port, and 2nd to real Address:Port.

i.e. ACL1: permit tcp any object MAPPED_IP eq 4444

ACL2: permit tcp any object INTERNAL_IP eq 443

Foud out by mere luck.

I guess this is a subtle way to ensure that Cisco TAC is kept busy :)