Cisco ASA 5510 - Behind a Cable modem

[andyferguson1977]

Hi guys

So I have a Cisco ASA 5510 ver 8.4(2), behind a cable modem with a dynamic ip address.  I just need some help on how to configure this device, by the way, I'm new to cisco.  Thanks

Here is my config so far.

interface Ethernet0/0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.198.1.45 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network 192.168.1.94-12012
host 192.168.1.94
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
object network 192.168.1.94-12012
nat (inside,outside) static interface
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp

[balaji.bandi]

How is your cable modem connected to what port, and what port user switch connected?

what is the issue you seeing now ?

[gbekmezi-DD]

If you cable modem is on E0/0 you should be mostly good to go. Why do you have this static object nat?

object network 192.168.1.94-12012
host 192.168.1.94
nat (inside,outside) static interface

I’d probably get rid of that if I were you. You can’t have a dynamic PAT for the interface and a 1:1 static NAT for the same interface address.

[andyferguson1977]

Got it.

Thank  you.  

What if I wanted to allow RDP using port 12012.  I'm having a hard time doing that

[balaji.bandi]

RDP from inside to outside or outside to inside ?

[andyferguson1977]

I would like to RDP to my computer at  home when I'm at my job

[andyferguson1977]

Can anyone help

[balaji.bandi]

yes this possible, only  contains i see here is your ISP - IP keep going change since its DHCP.

[Richard Burts]

In the config that you posted you are trying to just do a translation for the inside host address to the interface address. What you need to do is to configure port forwarding/redirection for the port for RDP. This specifies not only the address but also the protocol port numbers. So it will not translate all traffic arriving on the outside interface but will translate only that particular protocol. This link discusses how to do this and has an example showing both the use of ASDM and CLI. I hope you find it useful.

https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/118996-config-asa-00.html#anc10

HTH

Rick

[andyferguson1977]

Yes, to inside host with ip address 192.168.1.94