Port 5901 - Alternate Port?

[rpolanaroo]

With the Cisco ASA-5505, is there a more secure port that can be configured for VNC other than 5901? I am new to Firewalls in general so any detailed assistance would be greatly appreciated. We have a User who has requested that 5901 be opened but I was advised not to do so for security concerns.

I am fairly familar with the GUI but no command line experience.

Thank you,

Ron

[Jennifer Halim]

You could easily configure static PAT for the VNC traffic. Basically the user can connect to a different port than 5901 and the ASA can be configured to static PAT it back to 5901. So the ports that you would need to open on the ASA would be the port that the user is trying to connect to.

[rpolanaroo]

Jennifer, you're a life saver. How would I go about this? Would you be able (and this is ALLOT to ask) to provide me with some screen shots?

Thank you so much. I am scheduled for some classes and cannot wait to sink my teeth into them!

Thanks,

Ron

[Jennifer Halim]

Sure can...

Which version of ASA are you running?

[rpolanaroo]

First of all, THANK YOU. I don't know you from a hole in the wall but would that I could I'd see to that you got the rest of the year off with unlimited use of the Cisco Lear!

The version information is unfortunately at work, but it was purchased a year ago and no firmware updates have been installed.

However, many months ago I saw a post addressing the same issue I had at the time and you provided him (her?) with a screen capture with the following date/time stamp: Jan 13, 2011 7:49 PM (in response to noctech73)

The GUI is identical. Just found the url:

https://supportforums.cisco.com/thread/2062122

I also recently downloaded a backup of the configuration. Is there anything within there that can help you?

Thank you very much!

[Jennifer Halim]

LOL, I wish i have the rest of the year off

Great, back up copy would help, and I can give you the command line that you can just copy and paste into the configuration. Just let me know the internal IP Address of the VNC server, what IP Address you would like to NAT it to, as well as what other ports you would like the user to use when connecting from the internet.

You can just private message me the backup copy of the config instead of posting it on the forum. Let me know once you've forwarded, and i'll check it out for you. Cheers.