Opening ports on a DHCP outside ASA interface

[KeithAttreides_2]

Hello all,

I am used to setting up access-lists on outside interfaces with ip addresses that are static. I have recently been given a site that is using a dyndns.org client for name to ip address resolution on an outside interface that is dhcp assigned. I created an access-list to open up ports 41794 and 41795 to an engineering application but everytime I try to connect from the outside I get a syn timeout.

The application works when inside the lan.

Basically I want to allow outside connections from anywhere on the outside to go to ports 41794 and 41795. I am running a Cisco ASA 5505 on version 7.2(4)

Below is my conifg. Can anyone please point out what I may have misconfigured?

: Saved
:
ASA Version 7.2(4)
!
names
!
interface Vlan1
nameif inside
security-level 100
ip address 172.31.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name kroese.beach
access-list outside_access_in extended permit tcp any interface outside eq 41794
access-list outside_access_in extended permit tcp any interface outside eq 41795
access-list outside_access_in extended permit udp any interface outside eq 41794
access-list outside_access_in extended permit udp any interface outside eq 41795
access-list outside_access_in extended permit tcp any interface outside eq 3389
access-list Group1_splitTunnelAcl standard permit 172.31.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.31.2.0 255.255.255.0 172.31.10.0 255.255.255.224
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNDHCP 172.31.10.1-172.31.10.20 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 41794 172.31.2.225 41794 netmask 255.255.255.255
static (inside,outside) tcp interface 41795 172.31.2.225 41795 netmask 255.255.255.255
static (inside,outside) udp interface 41795 172.31.2.225 41795 netmask 255.255.255.255
static (inside,outside) udp interface 41794 172.31.2.225 41794 netmask 255.255.255.255
static (inside,outside) tcp interface 3389 172.31.2.150 3389 netmask 255.255.255.255
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
console timeout 10
dhcpd auto_config outside
!
dhcpd address 172.31.2.150-172.31.2.180 inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context

[Jennifer Halim]

Sorry, just trying to understand your requirements. Your ASA outside interface is DHCP assigned, and you would like your ASA to participate in DDNS so when its ip address changes, the DNS record gets changed as well.

If that is the correct understanding, where have you actually configured the DDNS? as I don't see that configuration under your ASA?

Since you are using the ASA outside interface which is DHCP assigned to access your internal server, if you have actually configured DDNS, where have you configured it on?

When you advise that everytime you get SYN timeout, how do you access the server? by dns name or by its ip address? also did you confirm that the dns name that you are trying to resolve, does resolve to the correct ip address that currently gets assigned to the ASA outside interface? and if you try to access it by ip address, did you also check that you are trying to reach the current ip address of the ASA outside interface?

Here is configuration guide on how to configure DDNS on ASA (assuming that you are supposed to configure DDNS on the ASA):

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/dhcp.html#wp1091527

[KeithAttreides_2]

Jennifer thanks for the reply. DDNS is working ok through a client on the inside network.

The issue is being able to access an application running on ports 41794 and 41795 from the outside. When on the inside the application runs but when beyond the LAN it cannot be accessed.

The server is access through a dns service provided by Dyndns.org. the DNS being resolved is correct and I am able to reach the ASA by the outside ip address as well.

I have configured the access-list, access-group, static mapping, and nat but something is incorrect. As I stated the application opens on the inside lan and is pingable. It is not running on an windows based system so it does not have an internal firewall. The only possible issue I can point to is the rules I have configured on the ASA.

Please take a look and if you see any mistakes or changes I should make let me know.

[Jennifer Halim]

Both static PAT as well as the access-list applied on the outside interface is correct.

Are you able to telnet on either port 41794 or 41795 to the public ip address when you are on the Internet?

Could it be that you require more ports to be opened?

You can check if more ports are required by configuring packet capture on the ASA outside interface, with access-list applied between your public ip address on the internet to the current public ip address assigned to the ASA outside interface, and view the capture to see what ports the application is attempting to use.

[KeithAttreides_2]

Jennifer,

I am not able to telnet to port 41794 or 41795 from the outside. When I do that I see a syn timeout on the ASA log.

It is possible that more ports need to be opened however this ASA was a replacement to a Sonicwall TZ 180 and that device only had those two ports opened to the outside world.

I will try a packet capture to see what information gets returned and post it. Thanks.

[Jennifer Halim]

Try to "clear xlate" and "clear local" on the ASA, and try to access it again.

If it still does not work, check the output of "show access-lit outside_access_in", and see if the hitcount increases for those lines that the application uses while you try to access the applications.

Packet capture would be great..