OPen port on ASA 5510

[samz]

Hi,

I want any IP on the LAN which is behind the firewall to access an IP 64.x.x.x outside the firewall (on the internet) example any ip 192.168.0.50 to access ip 61.x.x.x on port 6999.

How would I go about this.

Port 6999 does not need to be open inbound into my LAN only outbound (from my LAN out onto the internet).

Cheers,

SZ

[Jennifer Halim]

Here you go (I assume that you need access to port 6999 on TCP as the protocol, and assuming that the destination on the internet is 61.5.5.5:

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host 61.5.5.5 eq 6999

OR/ if you would like to access a subnet on 61.5.5.4/30, it would be as follows:

access-list inside_access_in extended permit tcp 192.168.0.0  255.255.255.0 61.5.5.4 255.255.255.252 eq 6999

Hope that helps.

[samz]

Hi,

Thanks for you help.

If I type this;

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host 61.5.5.5 eq 6999, where it has 192.168.0.0, does that give all my LAN subnet access or should I specify the IP address that I need to grant access to.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

[Jennifer Halim]

To be more restrictive, you can allow just the 1 ip address from your LAN as follows:

For example: If you need access from source 192.168.0.50 towards destination 61.5.5..5 on port 6999:

access-list inside_access_in extended permit tcp host 192.168.0.50 host 61.5.5.5 eq 6999

Hope that helps. Please kindly rate useful post as Cisco will match every rating to $1 for the Haiti Earthquake. Thanks.

[samz]

Hi,

Thanks for your help.

How would I let all LAN ip addresses to access the WAN IP on port 6999.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

[Jennifer Halim]

When you mention WAN IP, do you mean the router in front of the ASA? If that is the case, here is the config:

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host eq 6999

[samz]

Hi,

No this IP is for an application we use which connects to a server on the internet.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

[Jennifer Halim]

OK, so it would be:

access-list inside_access_in extended permit tcp 192.168.0.0  255.255.255.0 host eq 6999

[samz]

Thanks for your help.

I will try it and let you know.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

[samz]

Hi,

Below you have command

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host eq 6999

Where it says server IP, what should go in there,

Sam

[Jennifer Halim]

From your previous post, you mentioned this: "No this IP is for an application we use which connects to a server on  the internet."

So the destination ip address would be that server ip address that is on the Internet.