Problem with cisco 5510 port mapping

[raidokuvarnet]

Hello,

My device Cisco ASA 5510, ASA 8.4(2), ASDM 6.4(5)206

What I try to achieve.

1) Host 10.10.11.108 listening port 8080

2) Trying to access it from WAN e.g port 8090

I tried following commands:

object network 10.10.11.108_8080
host 10.10.11.108
nat (LAN1,WAN) static interface service tcp 8080 8090

access-list WAN_access_in line 11 extended permit tcp any object 10.10.11.108_8080 eq 8080
access-group WAN_access_in in interface WAN

But I don't gett access. Can someone help me to solve this case?

[Aditya Ganjoo]

Hi,

Please use the following command:

object service tcp-8090
service tcp source eq 8090

object service tcp-8080
service tcp destination eq 8080

nat (inside,outside) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090

Regards,

Aditya

[raidokuvarnet]

Okay, these commands were successful. Right now I can not access my service by port 8090. Do I need to configure Access Rule also?

[Aditya Ganjoo]

Hi,

Use a packet tracer command:

packet-tracer input wan tcp 4.2.2.2 8888 <interface ip> 8090 det 

Regards,

Aditya

[raidokuvarnet]

[Aditya Ganjoo]

Hi,

Please try opening the ACL on the WAN interface for the traffic.

Regards,

Aditya

[raidokuvarnet]

Not sure which service to add, so added both. Packet tracker results are same.

[Marius Gunnerud]

Actually, Aditya provided wrong object group config for the 8090 group.

object service tcp-8090
service tcp source eq 8090

this should be service "tcp destination eq 8090"

try changing this and then test again.

--

Please remember to select a correct answer and rate helpful posts

[raidokuvarnet]

Hello,

Deleted all previous and added new with tehese commands:

object service tcp-8090
service tcp destination eq 8090

object service tcp-8080
service tcp destination eq 8080

Nat (LAN1,WAN) 1 source static 10.10.11.108_8080 interface service tcp-8080 tcp-8090

Packet Tracker results are same:

[Marius Gunnerud]

The NAT now looks to be correct.  Could you post a full running config please.  remove any usernames, passwords and public IPs.

--

Please remember to select a correct answer and rate helpful posts 

[raidokuvarnet]

Here was running conf.

[Marius Gunnerud]

You access list should have a destination port of 8080 not 8090

access-list WAN_access_in extended permit object tcp-8090 any object 10.10.11.108_8080

--

Please remember to select a correct answer and rate helpful posts

[raidokuvarnet]

Here was running conf.

[Marius Gunnerud]

try changing the ACL entry to:

access-list WAN_access_in extended permit tcp any object 10.10.11.108_8080 eq 8080

--

Please remember to select a correct answer and rate helpful posts

[raidokuvarnet]

Hello,

Changed to your reccomendations. No change. I have read many forums and threads, but still no help.

[Marius Gunnerud]

Could you run the packet-tracer in CLI and paste the full output here please.

--

Please remember to select a correct answer and rate helpful posts