05-23-2024 03:59 PM
Hi Team,
So currently I have a FTD that I manage via FDM. Am trying to access an internal host from the outside via port 8888 but internally it should translate back to ssh (22). Screenshot is my nat rule. Not sure if am doing something wrong and what else am missing cause the rules I have it widely open to see if thats the issue but still nothing.
Solved! Go to Solution.
05-29-2024 04:02 AM
05-23-2024 11:32 PM
what is the error you getting when you initiate the connection from outside IP address and port 8888 ?
does the webserver running service 22 ? web server runs on generally 443 ? so what web server is this ?
i have tested in my Lab some time it works as expected for reference :
https://www.balajibandi.com/?p=1855
Debug - run on FDM or cli see if the packet reaching the outside interface or not first before it process NAT and inside ACL.
sometime the provider do not allow some incoming packets on odd ports.
05-24-2024 06:13 AM
Try packet-tracer from the FTD cli and let us know what you get.
packet-tracer input outside tcp 1.1.1.1 1234 <outside interface address> 8888
Also make sure there are no other rules or active connections using that same tcp port on the outside interface.
05-24-2024 06:38 AM - edited 05-24-2024 06:38 AM
first change the rule from auto to NAT rules before
second make sure you allow real IP and Port 22 in ACP
MHM
05-25-2024 10:14 AM
So changing it from auto you mean use manual nat like the image attached?
05-24-2024 03:47 PM
run a packet tracer from CLI, Verify that the access rules and NAT statements that are being hit are correct and that the action is allowed. If that looks good set up a packet capture on the webportal interface and see if there is traffic being captured in both directions. If you are only seeing traffic out towards the server but nothing in return, the the issue is either with the server itself or in the path between the firewall and the server.
If possible you can also run a tcpdump on the server in question and see if the SSH session is actually reaching the server.
05-27-2024 02:14 PM
How can I do this nat rule on a Cisco FTD using the FDM rather than the FMC?
05-29-2024 04:02 AM
Sorry I make you waiting
I was busy
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide