Port Forwarding Help!!

[livingdeadbeat]

After banging my head on my keyboard for about 3 days straight now I have to ask for help. I am trying to forward specific ports from the outside interface on my ASA5505 to my servers inside and can not get it to work! I have a VPN that currently works and the firewall rule in place I am just overlooking something simple I'm sure. Here is the config:

ASA Version 8.2(5)

!

hostname ASA

enable password <removed>

passwd <removed>

names

name 172.20.2.4 DC

name 172.20.2.7 VP

name 172.20.2.24 AP

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 172.20.0.3 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

ip address <Public-IP> 255.255.255.252

!

ftp mode passive

access-list inside_nat0_outbound extended permit ip any 172.20.22.0 255.255.255.192

access-list outside_access_in extended permit tcp any host <Public-IP>eq 2332

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5901

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5500

access-list outside_access_in extended permit tcp any host <Public-IP>eq 5705

access-list outside_access_in extended permit tcp any host <Public-IP>eq 81

pager lines 24

mtu inside 1500

mtu outside 1500

ip local pool VPN-IP-Pool 172.20.22.1-172.20.22.55 mask 255.255.0.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 172.20.0.0 255.255.0.0

static (inside,outside) tcp interface 2332 VP 2332 netmask 255.255.255.255

static (inside,outside) tcp interface 5901 VP 5901 netmask 255.255.255.255

static (inside,outside) tcp interface 5500 VP 5500 netmask 255.255.255.255

static (inside,outside) tcp interface 5705 AP 5705 netmask 255.255.255.255

static (inside,outside) tcp interface 81 AP 81 netmask 255.255.255.255

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 X.X.X.X 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server Radius protocol radius

aaa-server Radius (inside) host 172.20.0.3

timeout 5

key *****

aaa-server Radius (inside) host DC

timeout 5

key *****

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

http server enable

http 172.20.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set VPN esp-des esp-sha-hmac

crypto ipsec transform-set VPN mode transport

crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

crypto ipsec transform-set l2tp-transform esp-3des esp-sha-hmac

crypto ipsec transform-set l2tp-transform mode transport

crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set transform-set l2tp-transform vpn-transform

crypto dynamic-map dyn-map 10 set reverse-route

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map

crypto map vpn-map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 28800

crypto isakmp policy 15

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 50

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 172.20.0.0 255.255.0.0 inside

telnet timeout 5

ssh 172.20.0.0 255.255.0.0 inside

ssh timeout 20

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 172.20.2.4

vpn-tunnel-protocol l2tp-ipsec

default-domain value hq.vertique.com

username admin password <removed> privilege 15

tunnel-group DefaultRAGroup general-attributes

address-pool VPN-IP-Pool

authentication-server-group Radius

default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes

pre-shared-key *****

isakmp keepalive disable

tunnel-group DefaultRAGroup ppp-attributes

no authentication chap

authentication ms-chap-v2

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Thanks in advance for any input!

[jayturish]

Your first rules look funky. Are you doing one to one NAT or one to many NAT?

If you are just using your outside IP as your public and port forwarding to one or more internal hosts, your lines should look like this:

object-group service DM_INLINE_TCP_1 tcp

port-object eq 15961

port-object eq 88

port-object eq 9000

access-list outside_access_in extended permit icmp any any

access-list outside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1

static (inside,outside) udp interface 15961 172.16.0.3 15961 netmask 255.255.255.255

static (inside,outside) tcp interface 15961 172.16.0.3 15961 netmask 255.255.255.255

static (inside,outside) tcp interface 88 172.16.0.3 88 netmask 255.255.255.255

static (inside,outside) tcp interface 67 172.16.0.3 67 netmask 255.255.255.255

static (inside,outside) tcp interface 68 172.16.0.3 68 netmask 255.255.255.255

static (inside,outside) tcp interface 9000 172.16.0.3 9000 netmask 255.255.255.255

and your inside NAT statement also is wierd

here is mine

global (inside) 1 interface

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

[Jennifer Halim]

Your static PAT configuration and access-list looks correct to me.

Are you getting any hitcount on the access-list?

Are you able to telnet on those ports from the internet?

If you try to change it to the following (ie: using the interface keyword instead of the actual IP):

access-list outside_access_in extended permit tcp any interface outside eq 2332

access-list outside_access_in extended permit tcp any interface outside eq 5901

access-list outside_access_in extended permit tcp any interface outside eq 5500

access-list outside_access_in extended permit tcp any interface outside eq 5705

access-list outside_access_in extended permit tcp any interface outside eq 81

does it work?

[livingdeadbeat]

The traffic does hit the firewall rule and still does not work with the change mentioned with the desired service or ssh over these ports. This is a many to one NAT with the single public IP.

[livingdeadbeat]

I am using the ASA version 8.2(5) and the ASDM version 6.4(5) with this config.

[Jennifer Halim]

If the traffic does hit the firewall rule, can you pls share the output of :

show conn | i

Is there any firewall or access rules on the server itself that prevents inbound/incoming connection from the internet?

[livingdeadbeat]

The output of the show conn | i is blank ...

When I do a packet trace I get the following

VTQFW# packet-tracer input outside tcp 2332 172.20.2.7 2332 detailed

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xc97cbed8, priority=1, domain=permit, deny=false

        hits=60899, user_data=0x0, cs_id=0x0, l3_type=0x8

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0100.0000.0000

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   172.20.0.0      255.255.0.0     inside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xc97d2af0, priority=500, domain=permit, deny=true

        hits=0, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0

        src ip=, mask=255.255.255.255, port=0

        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

[Jennifer Halim]

When you use the packet-tracer, the destination ip address should be the ASA outside interface IP, not the private IP/real IP of the server, because when you actually connect from the internet/outside, you would be connecting to the public IP/NATed IP, not the private IP.

Here is how you should run the packet tracer:

packet-tracer input outside tcp 2332 2332 detailed

[livingdeadbeat]

After using the correct syntax with the trace the traffic is allowed through the firewall ...

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

[Jennifer Halim]

Excellent, good to hear it's working correctly now.

Pls kindly mark the post answered so others can learn from it. Thank you.

[livingdeadbeat]

The issue is still there. The traffic has always traversed the firewall, i was just using packet tracer incorrectly in troubleshooting. It almost has to be some thing in the NATing at this point doesn't it?

[Jennifer Halim]

If the issue is still there, i can assure you that it is not the ASA at this point.

If you use packet tracer and it allows the traffic through, then the ASA configuration is OK.

I would be looking into the server itself to see if there is any firewall on the server itself that might be preventing inbound connection from the internet.

[livingdeadbeat]

I can ssh into the server from the internet using a second gateway we currently have (and phasing out once this is resolved) so it is not the server as far as I can see it. Now you understand why I am so perplexed!

[Jennifer Halim · Accepted solution]

In that case, the default gateway of the server is pointing to the second gateway and the return traffic from the server doesn't pass through this particular ASA.

[livingdeadbeat]

Shouldn't the server respond back to the ASA since it initiated the request? I don't have the server set to send all traffic through the other gateway ...

A default gateway is the node on the computer network that the network software uses when an IP address does not match any other routes in the routing table.