New ASA 5508-X w/ firepower basic config help needed

[Chris Mickle]

Hello,

I just obtained an ASA 5508-X w/ firepower services running version 9.6 and am having real trouble getting what should be a simple configuration up and running. I have some experience with PIX and earlier (pre 8.4 apparently) versions of ASA, but this new configuration syntax for NAT and PAT is totally different and has really confused me. I'm posting this here because I have failed to find a set of complete information that I can understand elsewhere.

Here is the scenario...

We have a /29 address block from our ISP. The ISP's cable modem is in bridge mode and we will be using the ASA as our gateway. I need our entire network subnet natted to our first usable IP with the others reserved for future use. As of now, we have no VPN or VLAN configuration requirements. We have several servers on our inside network that will have a few ports forwarded to them. This is what is causing me the most trouble. I have the interfaces configured and I was able to use ASDM setup wizard to get internet access from the inside working, but I can not figure out the best way to configure the port forwarding.

Server 1 needs ports 491 and 2010-2018 forwarded to it.

Server 2 needs port 3389 forwarded to it.

There will probably be a few others, but if I can get these figured out I think I'll be able to handle it from there.

So... could someone please post the configuration steps necessary to properly setup PAT (I guess?)  for internet access and also the port forwarding commands.

I think I have the access lists configured correctly as they appear to be the same as the older syntax.

Thanks for your help.

[Chris Mickle]

Update...

I got most of the port forwarding working. I am still struggling however with forwarding the range 2010-2018. I have tried multiple config options and nothing seems to be working. I am posting my full config below in the hopes that someone can help me with this...

I need to forward tcp ports 2010-2018 to object network eagle

: Hardware:   ASA5508, 8192 MB RAM, CPU Atom C2000 series 2000 MHz, 1 CPU (8 cores)
:
ASA Version 9.6(1)
!
hostname ciscoasa

names

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address x.x.x.x 255.255.255.248
!
interface GigabitEthernet1/2
 nameif domain
 security-level 100
 ip address 10.100.15.1 255.255.255.0
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
ftp mode passive
dns server-group DefaultDNS
 domain-name xxx.xxx
object network domain_internet
 subnet 10.100.15.0 255.255.255.0
object network vmhost
 host 10.100.15.18
object network eagle
 host 10.100.15.10
access-list 100 extended permit tcp any object vmhost eq 3389
access-list 100 extended permit tcp any object eagle eq 491
access-list 100 extended permit tcp any object eagle range 2010 2018
pager lines 24
logging asdm informational
mtu outside 1500
mtu domain 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network domain_internet
 nat (domain,outside) dynamic interface
object network vmhost
 nat (domain,outside) static interface service tcp 3389 3389
object network eagle
 nat (domain,outside) static interface service tcp 491 491
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 10.100.15.0 255.255.255.0 domain
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
 
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous