I hope someone can help me. I have a customer with an 877ISR with zone base firewall.
They want to access two servers on the inside from the internet using RDP but with different ports.
Partial configuration if anyone can tell me where I am going wrong.
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
zone-member security out-zone
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ppp chap password 7 151019030E253F2B3B203C
ppp pap sent-username xxxxxxxxxxxxxxxxxxxxxx password 7 06041D2E46411D1616041B
!
interface BVI1
description $ES_LAN$$FW_INSIDE$
ip address 192.168.7.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security in-zone
class-map type inspect match-all ccp-protocol-rdp
match access-group 101
policy-map type inspect ccp-permit-in
class type inspect ccp-protocol-rdp
inspect
class class-default
drop
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-out-in source out-zone destination in-zone
service-policy type inspect ccp-permit-in
ip nat inside source static tcp 192.168.7.100 3389 interface Dialer0 33888
ip nat inside source static tcp 192.168.7.121 3389 interface Dialer0 3390
access-list 101 permit tcp host <dialer0 address> any eq 33888
access-list 101 permit tcp host <dialer0 address> any eq 3390
