cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2128
Views
5
Helpful
4
Replies
Beginner

ASA 8.4(4)1 Port Forward

I know this has been asked before and I have looked through dozens of forums trying to get this to work.

Here is where I am at.  I can get out to the internet.  My internet works.  However port forwarding does not work.  I want to port forward from the outside to inside obviously.  I get an error in my log file which Ill show you and then I will share the running-config

I have tried using this method found elsewhere.   Id buy you a pie for Thanksgiving but hey how about a thanks and a rating?

========================================================================================================

ATTEMPTED CONFIG

object network inside-host

  host 192.168.100.4

  nat (inside,outside) static interface service tcp 3389 3389


access-list Outside-2-Inside line 1 extended permit tcp any host 192.168.100.4 eq 3389 log informational interval 300

access-group Outside-2-Inside in interface outside

========================================================================================================

ERROR RECIEVED FROM SH LOG | I 3389

%ASA-7-710005: TCP request discarded from <external-source>/33829 to outside:<external-destination>/3389

%ASA-7-710005: TCP request discarded from <external-source>/33829 to outside:<external-destination>/3389

========================================================================================================

RUNNING-CONFIG

: Saved

: Written by enable_15 at 14:43:22.459 UTC Wed Nov 21 2012

!

ASA Version 8.4(4)1

!

hostname NDemers-ASA

enable password uyZM9L3b1Su6zlf8 encrypted

passwd iR0UgA3QDI9onOxJ encrypted

names

!

interface Ethernet0/0

switchport access vlan 10

!

interface Ethernet0/1

switchport access vlan 192

!

interface Ethernet0/2

switchport access vlan 192

!

interface Ethernet0/3

switchport access vlan 192

!

interface Ethernet0/4

switchport access vlan 192

!

interface Ethernet0/5

switchport access vlan 192

!

interface Ethernet0/6

switchport access vlan 192

!

interface Ethernet0/7

switchport access vlan 192

!

interface Vlan1

no nameif

no security-level

no ip address

!

interface Vlan10

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan192

nameif inside

security-level 100

ip address 192.168.100.1 255.255.255.0

!

ftp mode passive

object network obj-any

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network INSIDE_HOST

host 192.168.100.4

access-list Inside-2-Outside extended permit ip any any

access-list Inside-2-Outside extended deny ip any any

access-list Outside-2-Inside extended permit tcp any host 192.168.100.4 eq 3389 log

access-list Outside-2-Inside extended permit ip any any

access-list Outside-2-Inside extended deny ip any any

pager lines 24

logging enable

logging monitor debugging

logging buffered debugging

mtu outside 1500

mtu inside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-649-103.bin

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic any interface

!

object network obj_any

nat (inside,outside) dynamic interface

object network INSIDE_HOST

nat (inside,outside) static interface service tcp 3389 3389

access-group Outside-2-Inside in interface outside

access-group Inside-2-Outside global

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh x.x.x.x 255.255.255.255 outside

ssh 192.168.100.0 255.255.255.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd address 192.168.100.2-192.168.100.20 inside

dhcpd dns 8.8.8.8 4.4.2.2 interface inside

dhcpd option 3 ip 192.168.100.1 interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username nated password L3LhK0WEjivHU8Xd encrypted

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f657672163e7ea4e6fd62d9780506a48

: end

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

ASA 8.4(4)1 Port Forward

Hello,

Do the following,

object service RDP

service tcp source eq 3389

object network inside-host

  host 192.168.100.4

  no nat (inside,outside) static interface service tcp 3389 3389

   exit

nat (inside,outside) 1 source static inside-host interface service RDP RDP

This will make it work (what about  the pie, the thanks and the rating lol )

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

4 REPLIES 4
Highlighted
Beginner

Re: ASA 8.4(4)1 Port Forward

Hi,

The way I understand the error is your testing your port-forward from a client inside your asa's inside network. By default, the appliance wont allow it. You're essentially leaving and entering the same interface

Configure U-turning or Hairpinning

Highlighted
Beginner

ASA 8.4(4)1 Port Forward

My test is done by remoting into my work PC and from there I try to remote so it is pure external no U-Turn stuff.  Is that what you were referring to?  If not could you be more specific in regards to my config?

Highlighted

ASA 8.4(4)1 Port Forward

Hello,

Do the following,

object service RDP

service tcp source eq 3389

object network inside-host

  host 192.168.100.4

  no nat (inside,outside) static interface service tcp 3389 3389

   exit

nat (inside,outside) 1 source static inside-host interface service RDP RDP

This will make it work (what about  the pie, the thanks and the rating lol )

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Highlighted
Beginner

ASA 8.4(4)1 Port Forward

So I had to clean up my code a bit but that worked like a charm.  Very good work.  I feel so relieved about this.  THANK YOU!

You earned your little stars today friend!