Please help,
For some reason I keep getting denied when configuring port forwarding on an ASA 5510. The current topology is Internet----Modem-----Router--------ASA 5510 (Active/Standby)---------Inside------PHP_TEST
If I am allowing to open a web server 192.168.2.5 to be accessed from OUTSIDE with the configuration below, I keep getting denied. Can you please advise what configuration needed. Thanks in advance.
object network PHP_TEST
host 192.168.2.5
nat (INSIDE,OUTSIDE) static interface service tcp 80 80
access-list OutsideToPHPServer permit tcp any host 192.168.2.5 eq www
access-group OutsideToPHPServer in interface OUTSIDE
---------------------------------------------------------------------------
Below is my configuration, which I omitted unnecessary config for this issue.
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
ASA Version 9.1(6)
!
hostname XXXXXXXXXXXXXXXX
domain-name XXXXXXXXXXXXXXXXXXXXXXX
enable password XXXXXXXXXXXXXXXXX encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd XXXXXXXXXXXXXXXX encrypted
names
dns-guard
ip local pool RVPN_User 10.0.0.1-10.0.0.10 mask 255.255.255.0
!
interface Ethernet0/0
description *** Connection to Router Plutus ***
nameif OUTSIDE
security-level 0
ip address 192.168.1.2 255.255.255.0 standby 192.168.1.10
!
interface Ethernet0/1
description *** Connection to DMZ Zone ***
nameif DMZ
security-level 55
ip address 192.168.3.1 255.255.255.0 standby 192.168.3.10
!
interface Ethernet0/2
description *** Connection to LAN ***
nameif INSIDE
security-level 55
ip address 192.168.2.1 255.255.255.0 standby 192.168.2.10
!
interface Ethernet0/3
description *** Available Link ***
shutdown
nameif DMZ2
security-level 55
ip address 192.168.5.1 255.255.255.0
!
interface Management0/0
description LAN Failover Interface
management-only
!
!
boot system disk0:/asa916-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup OUTSIDE
dns server-group DefaultDNS
name-server 208.67.222.222
name-server 208.67.220.220
domain-namexxxxxxxxxxxxxxxxxxxxxxxxxx
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network PHP_TEST
host 192.168.2.5
object network dmz-subnet
subnet 192.168.3.0 255.255.255.0
object network inside-subnet
subnet 192.168.2.0 255.255.255.0
object network Outside_Network
subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_10.0.0.0_28
subnet 10.0.0.0 255.255.255.240
object service HTTP
service tcp source eq www
object-group service DM_INLINE_SERVICE_2
service-object tcp-udp destination eq www
service-object tcp destination eq www
service-object udp destination eq www
object-group network DMZ-subnet
network-object 192.168.3.0 255.255.255.0
object-group network opendns-servers
network-object host 208.67.220.220
network-object host 208.67.220.222
object-group network googledns-servers
network-object host 8.8.4.4
network-object host 8.8.8.8
object-group service DM_INLINE_SERVICE_1
service-object tcp destination eq www
service-object udp destination eq www
access-list OUTSIDE_access_in extended permit ip any4 any4
access-list DMZ_access_in extended permit ip any4 any4 log disable
access-list OUTSIDE_access_in_1 extended permit ip any any log disable
access-list outside_acl extended permit ip any4 192.168.3.0 255.255.255.0 log disable
access-list outside_acl extended permit ip any4 any4
access-list inbound extended permit ip any4 any4 log disable
access-list global_mpc extended permit ip any any
access-list inside_access_in extended permit ip any4 any4 log disable
access-list inside_access_out extended permit ip any4 any4
pager lines 24
logging enable
logging timestamp
logging trap informational
logging asdm informational
logging host INSIDE 192.168.2.12
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
flow-export destination INSIDE 192.168.2.12 2055
mtu OUTSIDE 1500
mtu DMZ 1500
mtu INSIDE 1500
mtu DMZ2 1500
ip verify reverse-path interface OUTSIDE
failover
failover lan unit primary
failover lan interface FAILOVER Management0/0
failover key *****
failover interface ip FAILOVER 172.16.254.254 255.255.255.0 standby 172.16.254.250
icmp unreachable rate-limit 1 burst-size 1
icmp permit any OUTSIDE
icmp permit any DMZ
icmp permit 192.168.3.0 255.255.255.0 DMZ
asdm image disk0:/asdm-771.bin
asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (INSIDE,OUTSIDE) source static PHP_TEST PHP_TEST service HTTP HTTP
!
object network dmz-subnet
nat (DMZ,OUTSIDE) dynamic interface
object network inside-subnet
nat (INSIDE,OUTSIDE) dynamic interface
access-group OUTSIDE_access_in_1 in interface OUTSIDE
access-group DMZ_access_in in interface DMZ
access-group inside_access_out out interface INSIDE
route OUTSIDE 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
no snmp-server location
no snmp-server contact
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OUTSIDE_map interface OUTSIDE
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=APOLLO
crl configure
crypto ca trustpool policy
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.1.0 255.255.255.0 OUTSIDE
ssh 192.168.3.0 255.255.255.0 DMZ
ssh 192.168.2.0 255.255.255.0 INSIDE
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcprelay timeout 60
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 216.239.35.0 source OUTSIDE prefer
ssl trust-point ASDM_TrustPoint0 INSIDE
ssl trust-point ASDM_TrustPoint0 OUTSIDE
ssl trust-point ASDM_TrustPoint0 DMZ2
ssl trust-point ASDM_TrustPoint0 DMZ
webvpn
!
class-map global-class
match access-list global_mpc
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class global-class
flow-export event-type all destination 192.168.2.12
class inspection_default
inspect esmtp
inspect ftp
inspect h323 h225
inspect h323 ras
inspect icmp
inspect icmp error
inspect netbios
inspect rsh
inspect rtsp
inspect sip
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
class class-default
user-statistics accounting
!
service-policy global_policy global
