02-08-2017 07:53 AM - edited 03-12-2019 01:54 AM
Good afternoon, I have an ASA 5506 I'm having difficulty redirecting the public ip 200,188,213,171 ----> to get the IP address at 172.18.37.11:8080 that our Cameras nvr and get external access in the browser by typing;
Http://200.188.213.171:8080 Help?
Solved! Go to Solution.
02-08-2017 11:09 AM
With:
access-list NVR1 extended permit tcp host 200.188.213.171 host 172.18.37.11 eq 8080
You are restricting to host 200.188.213.171 to 172.18.37.11.
for testing, allow "any" and test from a different outside connection....rather than testing in and out same firewall.
Just for a test:
access-list NVR1 permit tcp any host 172.18.37.11 eq 8080
and test from another outside connection, other than the same firewall.
02-08-2017 04:03 PM
Doubt, this ip need to access 200.188.213.171:8080 and 200.188.213.171:8081
Being that 200.188.213.171 ---> 172.18.37.11:8080
200.188.213.171 ---> 172.18.37.12:8081 but this configuration of mine only works one and not both simultaneously
FW001(config)# end
FW001# show run
FW001# show running-config
: Saved
:
: Serial Number: JAD193400NV
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif outside
security-level 0
ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network NVR2-172.18.37.12
host 172.18.37.12
object network NVR1-172.18.37.11
host 172.18.37.11
access-list NVR1 extended permit tcp any host 172.18.37.11 eq 8080
access-list NVR2 extended permit tcp any host 172.18.37.12 eq 8081
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NVR2-172.18.37.12
nat (inside,outside) static interface service tcp 8081 8081
object network NVR1-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
access-group NVR1 in interface outside
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:c986fc9bf1f732e8d986b72b4951b733
: end
FW001#
02-08-2017 04:10 PM
Thanks, it worked but only one targeting and the other one is configured in the same way it unconfigures the other configuration created
02-09-2017 04:15 AM
There can only be one access-group applied to an interface, per direction. In your case, this is currently done using the "access-list NVR1 in interface outside" command.
You created another access-list (NVR2) - but this is not applied to the interface with the access-group command. Its just an access-list
Easiest thing to do, is just and another entry for access-list NVR1:
access-list NVR1 extended permit tcp any host 172.18.37.12 eq 8081
Then if you have more cameras, just keep adding them under this ACL - NVR1, since this is the one applied to the outside interface.
If you dont like the name NVR1, create a new ACL, then apply that ACL to the outside interface with the access-group command....but there can only be one access-group applied to that interface.
Just a thought also, use https if possible, the username/passwords are unencrypted when accessing the cameras...if that is important to you.
In addition, now that you know the rules are working, you can also tighten it down on your ACL, to only trusted Public IP's...if that is possible in your case...it may not be.
02-09-2017 03:06 PM
Perfect, thanks for helping me, it worked
object network NVR1-172.18.37.11
host 172.18.37.11
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR1-172.18.37.12
host 172.18.37.12
access-list NVR1 extended permit tcp any host 172.18.37.11 eq 8080
access-list NVR1 extended permit tcp any host 172.18.37.12 eq 8081
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NVR1-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
object network NAT-LAN
nat (inside,outside) dynamic interface
object network NVR1-172.18.37.12
nat (inside,outside) static interface service tcp 8081 8081
access-group NVR1 in interface outside
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
02-08-2017 10:43 AM
Can you post the new config
02-08-2017 10:49 AM
show run
FW001(config)# show running-config
: Saved
:
: Serial Number: JAD193400NV
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cor es)
:
ASA Version 9.5(2)6
!
hostname FW001
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 172.18.37.254 255.255.255.0
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif outside
security-level 0
ip address 200.188.213.171 255.255.255.0
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network NAT-LAN
subnet 172.18.37.0 255.255.255.0
object network NVR-172.18.37.11
host 172.18.37.11
object network NVR1
access-list NVR1 extended permit tcp host 200.188.213.171 host 172.18.37.11 eq 8080
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network NAT-LAN
nat (inside,outside) dynamic interface
object network NVR-172.18.37.11
nat (inside,outside) static interface service tcp 8080 8080
access-group NVR1 in interface outside
route outside 0.0.0.0 0.0.0.0 200.188.213.169 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:aaefa4d7d2573c97909739849e2a816b
: end
FW001(config)#
02-08-2017 10:33 AM
Did this way but did not work!
configure mode commands/options:
WORD Specify the name of an access-list
FW001(config-network-object)# ACCess-group NVR1 ?
configure mode commands/options:
global For traffic on all interfaces
in For input traffic
out For output traffic
<cr>
FW001(config-network-object)# ACCess-group NVR1 IN
FW001(config-network-object)# ACCess-group NVR1 IN ?
configure mode commands/options:
interface Keyword to specify an interface
FW001(config-network-object)# ACCess-group NVR1 IN interf
FW001(config-network-object)# ACCess-group NVR1 IN interface ?
configure mode commands/options:
Current available interface(s):
inside Name of interface GigabitEthernet1/1
outside Name of interface GigabitEthernet1/8
FW001(config-network-object)# ACCess-group NVR1 IN interface OUTSIDE
FW001(config)#
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide