Hi,
So you would like to know how to forward certain TCP ports traffic from the ASAs outside interface to the local router behind it
Heres examples for both old and new softwares
- 8.2 and below
- 8.3 and above
Check your firewalls software level with "show version" command on the CLI
8.2 and below configuration format
static (inside,outside) tcp interface 8023 10.10.10.10 23 netmask 255.255.255.255
access-list OUTSIDE-IN permit tcp any host eq 8023
Where
- inside = source interface
- outside = destination interface
- tcp = protocol for forward
- interface = the public IP used is "outside" interfaces
- 8023 = mapped port facing public network
- 23 = real port on the local router
8.3 and above
- Notice that contrary to the older software the ACL rules are made with the Local IP address and Local/real port of the LAN device
object network PORTFORWARD-MGMT
host 10.10.10.10
nat (inside,outside) static interface service tcp 23 8023
access-list OUTSIDE-IN permit tcp any object PORTFORWARD-MGMT eq 23
Where
- PORTFORWARD-MGMT = name of the object under which the Local IP address for NAT and the actual NAT configuration
- inside = source interface
- outside = destination interface
- tcp = protocol for forward
- interface = the public IP used is "outside" interfaces
- 8023 = mapped port facing public network
- 23 = real port on the local router
Naturally in both cases you should consider what source address to use in the ACL statements. For examples sake I just used the keyword "any" that would allow anyone to connect.
Please rate the answer if the information was helpfull
- Jouni
