Cisco 1140 FTD additional public IP range

[peat]

Hi, 

I am struggling to get my head around how to get an additional public ip range working through a cisco 1140 ftd.

I had asked previously and was told there arent alias interfaces or suchlike on the FTD like there is on Sophos and was told to just use static nat.

Ive watched a ton of videos and looked online and I keep finding different suggestions. (I cant get any to work anyway)

Below is a bad diagram of what my setup looks like (ive used made up public ips just for an example).

What i want to do is

1)  traffic from the internet to the web server for http, https, udp 59221, tcp 59221 using the public ip 205.20.111.36

2)  rdp to the rdp server using the public ip 205.20.111.33 but port 45456

3) have the public ip of 205.20.111.38 work on the internal router.

For 2) I have tried just doing a normal static nat with and without RDP port in destination port fields (ive also got it disabled at the moment but when testing i have enabled the status)

For info, internet out is working fine and i can remote onto the firewall fine too. so those basics are all ok.  Oh i also forgot on my diagram i have an inside interface on subnet 192.168.1.x and also another interface on 192.168.3.x

If anyone could help it would be gratefully received.

[peat]

yeah i just have left rdp at 3389 for the moment for testing but will change that once it all works.

yeah i had the source IP on packet tracer as the one thats the allowed IP on the ACL.   Ill remove that from the acl and test again

[peat]

Well this is odd.  Its failing the deployment when i try and remove the support IP from the RDP rule.  So I have gone on the cli and the rdp rule is not there.  But its showing on the FTD Gui.

access-group NGFW_ONBOX_ACL global
access-list NGFW_ONBOX_ACL remark rule-id 268435460: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435460: L5 RULE: DNAT_Sig
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435460 ifc outside any ifc inside object SigServer_INT rule-id 268435460 event-log flow-end

access-list NGFW_ONBOX_ACL remark rule-id 268435457: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435457: L7 RULE: Inside_Outside_Rule
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435457 ifc inside any ifc outside any rule-id 268435457 event-log both

access-list NGFW_ONBOX_ACL remark rule-id 268435464: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435464: L5 RULE: WAN_internalPubrange
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435464 ifc outside object any-ipv4 object Internal_Pub_IP_range rule-id 268435464 event-log flow-end

access-list NGFW_ONBOX_ACL remark rule-id 268435458: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435458: L7 RULE: Prod_WAN
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435458 ifc prod any ifc outside any rule-id 268435458

access-list NGFW_ONBOX_ACL remark rule-id 1: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 1: L5 RULE: DefaultActionRule
access-list NGFW_ONBOX_ACL advanced deny ip any any rule-id 1

access-list NGFW_ONBOX_ACL remark rule-id 268435462: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435462: L5 RULE: LAN_Prod
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435462 ifc inside any ifc prod any rule-id 268435462

access-list NGFW_ONBOX_ACL remark rule-id 268435463: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435463: L5 RULE: Prod_LAN
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435463 ifc prod any ifc inside any rule-id 268435463

[Aref Alsouqi · Accepted solution]

Could be a software bug and this could be why it was showing no match on any rule but the default one when you ran packet tracer. Could you please try to add a replica of the DNAT_RDP rule, deploy and test again?

[peat]

Thats got it.  shame I cant get rid of that ghost bugged rule but its working now thats the main thing.

Thanks

[Aref Alsouqi]

I'm so glad that the issue is now fixed. Out of interest, what software version is running on the firewall? currently the golden recommended release for Firepower 1140 is 7.4.2, if you are not on that version I would recommend to try to upgrade the device, hopefully that will eliminate the ghost rule.

Software Download - Cisco Systems

[peat]

its on 7.2.5-208.  I had a look when it was first installed and it said no software updates on the system but now you have said that am i to assume it doesnt auto check for updates like a Sophos does?  

Since its on 7.2 will i have to do step upgrades or can i just go straight for 7.4.2?

[Aref Alsouqi]

I don't think FDM does the auto check, however, the latest releases of the FMC do, you basically get a pop up message suggesting to upgrade to the latest recommended release.

Yes you can go direct from your current release to version 7.4.2. Once that is done then you should apply the available patch.

[MHM Cisco World]

No need this any more.

MHM