Cisco ASA 9.8 setting up a nat using multiple ports

[KEN COUSINO JR.]

I am trying to setup a NAT for my video camera for outside access.  I need multiple ports to be allowed.  I would like to use services object groups for this.  Please help.

Camera 1 - 192.168.5.43

Camera 2 - 192.168.5.44

Camera 3 - 192.168.5.45

Ports 81, 82, 83, 84, 8000

Thanks,
Ken

[Sheraz.Salim]

object-group network CAM

  network-object host 192.168.5.43

  network-object host 192.168.5.44

  network-object host 192.168.5.45

!

object-group service Ports
 service-object tcp source eq 81
 service-object tcp source eq 82
 service-object tcp source eq 83
 service-object tcp source eq 84
 service-object tcp source eq 8000

!

nat (inside,outside) source static CAM interface

!

access-list CAM_IN extend permit object-group Ports any object-group CAM

access-group CAM_IN in iterface outside

[KEN COUSINO JR.]

I am realizing that I also need to mention that this is on a ASA 5506x and it is using a Bridge group.

[Sheraz.Salim]

Above command will work on 5506 with bridge group 

[KEN COUSINO JR.]

Do you have to assign to every inside port since they are individually labelled and part of the bridge group?

[Sheraz.Salim]

upload your config i shall make the change accordingly.

[KEN COUSINO JR.]

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address
!
interface GigabitEthernet1/2
bridge-group 1
nameif inside_1
security-level 100
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif inside_6
security-level 100
!
interface GigabitEthernet1/8
bridge-group 1
nameif inside_7
security-level 100
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
nameif inside
security-level 100
ip address 192.168.5.1 255.255.255.0
!
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-192.168.5.43
host 192.168.5.43
object network obj-192.168.5.43-1
host 192.168.5.43
object network obj-192.168.5.43-2
host 192.168.5.43
object network obj-192.168.5.43-3
host 192.168.5.43
object network obj-192.168.5.43-4
host 192.168.5.43
object network obj-192.168.5.43-5
host 192.168.5.43
object network obj-192.168.5.0
subnet 192.168.5.0 255.255.255.0
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq 8000
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq www
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq 81
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq 82
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq 83
access-list outside_access_in extended permit tcp any4 host 192.168.5.43 eq 84

!
object network obj_any1
nat (inside_1,outside) dynamic interface
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network obj_any6
nat (inside_6,outside) dynamic interface
object network obj_any7
nat (inside_7,outside) dynamic interface
object network obj-192.168.5.43
nat (inside_1,outside) static interface service tcp 8000 8000
object network obj-192.168.5.43-1
nat (inside_1,outside) static interface service tcp www www
object network obj-192.168.5.43-2
nat (inside_1,outside) static interface service tcp 81 81
object network obj-192.168.5.43-3
nat (inside_1,outside) static interface service tcp 82 82
object network obj-192.168.5.43-4
nat (inside_1,outside) static interface service tcp 83 83
object network obj-192.168.5.43-5
nat (inside_1,outside) static interface service tcp 84 84
access-group outside_access_in in interface outside
access-group inside_access_out in interface inside

[Sheraz.Salim · Accepted solution]

try this config. I have try to configure the service objects as you requested but this is not possible as we have no source ip address known. service object work with source ip and with destination ip. in our case source ip address is any ip address from the internet and the destination ip address is our group CAM.

!

!object-group network CAM
  network-object host 192.168.5.43
  network-object host 192.168.5.44
  network-object host 192.168.5.45
!
object-group protocol TCP
 protocol-object tcp
!
nat (inside1,outside) source static CAM interface
!
access-list outside_access_in extend permit object-group TCP any object-group CAM eq 81
access-list outside_access_in extend permit object-group TCP any object-group CAM eq 82
access-list outside_access_in extend permit object-group TCP any object-group CAM eq 83
access-list outside_access_in extend permit object-group TCP any object-group CAM eq 84
access-list outside_access_in extend permit object-group TCP any object-group CAM eq 8000
!
access-group outside_access_in in iterface outside