cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
719
Views
0
Helpful
2
Replies

ASA 5510 Port Forwarding Issue

limjohn23
Level 1
Level 1

Please help,

For some reason I keep getting denied when configuring port forwarding on an ASA 5510. The current topology is Internet----Modem-----Router--------ASA 5510 (Active/Standby)---------Inside------PHP_TEST

If I am allowing to open a web server 192.168.2.5 to be accessed from OUTSIDE with the configuration below, I keep getting denied. Can you please advise what configuration needed. Thanks in advance.


object network PHP_TEST

     host 192.168.2.5

nat (INSIDE,OUTSIDE) static interface service tcp 80 80

access-list OutsideToPHPServer permit tcp any host 192.168.2.5 eq www

access-group OutsideToPHPServer in interface OUTSIDE

---------------------------------------------------------------------------

Below is my configuration, which I omitted unnecessary config for this issue.

: Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz

ASA Version 9.1(6)

!

hostname XXXXXXXXXXXXXXXX

domain-name XXXXXXXXXXXXXXXXXXXXXXX

enable password XXXXXXXXXXXXXXXXX encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd XXXXXXXXXXXXXXXX encrypted

names

dns-guard

ip local pool RVPN_User 10.0.0.1-10.0.0.10 mask 255.255.255.0

!

interface Ethernet0/0

description *** Connection to Router Plutus ***

nameif OUTSIDE

security-level 0

ip address 192.168.1.2 255.255.255.0 standby 192.168.1.10

!

interface Ethernet0/1

description *** Connection to DMZ Zone ***

nameif DMZ

security-level 55

ip address 192.168.3.1 255.255.255.0 standby 192.168.3.10

!

interface Ethernet0/2

description *** Connection to LAN ***

nameif INSIDE

security-level 55

ip address 192.168.2.1 255.255.255.0 standby 192.168.2.10

!

interface Ethernet0/3

description *** Available Link ***

shutdown

nameif DMZ2

security-level 55

ip address 192.168.5.1 255.255.255.0

!

interface Management0/0

description LAN Failover Interface

management-only

!

!

boot system disk0:/asa916-k8.bin

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns domain-lookup OUTSIDE

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-namexxxxxxxxxxxxxxxxxxxxxxxxxx

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network PHP_TEST

host 192.168.2.5

object network dmz-subnet

subnet 192.168.3.0 255.255.255.0

object network inside-subnet

subnet 192.168.2.0 255.255.255.0

object network Outside_Network

subnet 192.168.1.0 255.255.255.0

object network NETWORK_OBJ_10.0.0.0_28

subnet 10.0.0.0 255.255.255.240

object service HTTP

service tcp source eq www

object-group service DM_INLINE_SERVICE_2

service-object tcp-udp destination eq www

service-object tcp destination eq www

service-object udp destination eq www

object-group network DMZ-subnet

network-object 192.168.3.0 255.255.255.0

object-group network opendns-servers

network-object host 208.67.220.220

network-object host 208.67.220.222

object-group network googledns-servers

network-object host 8.8.4.4

network-object host 8.8.8.8

object-group service DM_INLINE_SERVICE_1

service-object tcp destination eq www

service-object udp destination eq www

access-list OUTSIDE_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit ip any4 any4 log disable

access-list OUTSIDE_access_in_1 extended permit ip any any log disable

access-list outside_acl extended permit ip any4 192.168.3.0 255.255.255.0 log disable

access-list outside_acl extended permit ip any4 any4

access-list inbound extended permit ip any4 any4 log disable

access-list global_mpc extended permit ip any any

access-list inside_access_in extended permit ip any4 any4 log disable

access-list inside_access_out extended permit ip any4 any4

pager lines 24

logging enable

logging timestamp

logging trap informational

logging asdm informational

logging host INSIDE 192.168.2.12

no logging message 106015

no logging message 313001

no logging message 313008

no logging message 106023

no logging message 710003

no logging message 106100

no logging message 302015

no logging message 302014

no logging message 302013

no logging message 302018

no logging message 302017

no logging message 302016

no logging message 302021

no logging message 302020

flow-export destination INSIDE 192.168.2.12 2055

mtu OUTSIDE 1500

mtu DMZ 1500

mtu INSIDE 1500

mtu DMZ2 1500

ip verify reverse-path interface OUTSIDE

failover

failover lan unit primary

failover lan interface FAILOVER Management0/0

failover key *****

failover interface ip FAILOVER 172.16.254.254 255.255.255.0 standby 172.16.254.250

icmp unreachable rate-limit 1 burst-size 1

icmp permit any OUTSIDE

icmp permit any DMZ

icmp permit 192.168.3.0 255.255.255.0 DMZ

asdm image disk0:/asdm-771.bin

asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (INSIDE,OUTSIDE) source static PHP_TEST PHP_TEST service HTTP HTTP

!

object network dmz-subnet

nat (DMZ,OUTSIDE) dynamic interface

object network inside-subnet

nat (INSIDE,OUTSIDE) dynamic interface

access-group OUTSIDE_access_in_1 in interface OUTSIDE

access-group DMZ_access_in in interface DMZ

access-group inside_access_out out interface INSIDE

route OUTSIDE 0.0.0.0 0.0.0.0 192.168.1.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

no snmp-server location

no snmp-server contact

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec security-association pmtu-aging infinite

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map OUTSIDE_map interface OUTSIDE

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

subject-name CN=APOLLO

crl configure

crypto ca trustpool policy

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable OUTSIDE client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

no ssh stricthostkeycheck

ssh 192.168.1.0 255.255.255.0 OUTSIDE

ssh 192.168.3.0 255.255.255.0 DMZ

ssh 192.168.2.0 255.255.255.0 INSIDE

ssh timeout 60

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcprelay timeout 60

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 216.239.35.0 source OUTSIDE prefer

ssl trust-point ASDM_TrustPoint0 INSIDE

ssl trust-point ASDM_TrustPoint0 OUTSIDE

ssl trust-point ASDM_TrustPoint0 DMZ2

ssl trust-point ASDM_TrustPoint0 DMZ

webvpn

!

class-map global-class

match access-list global_mpc

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class global-class

  flow-export event-type all destination 192.168.2.12

class inspection_default

  inspect esmtp

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect icmp

  inspect icmp error

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect sip

  inspect skinny

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect xdmcp

class class-default

  user-statistics accounting

!

service-policy global_policy global

2 Replies 2

dbrittin
Community Manager
Community Manager

Hi,

You may also want to post this in the Cisco Technical Support Forum: https://supportforums.cisco.com/

Denise Brittin

Manager, Cisco Communities

Thanks Denise.

Review Cisco Networking for a $25 gift card