Hey all,
i have a customer (small business) without a static external IP adress. They use a VoIP solution with an internal appliance and i have to forward some ports and a port range to the VoIP device. I use a Firepower 1010 with ASA 9.16
What i have so far:
object service RTP-Daten
service udp source range 10000 20000
object service Autoprov
service tcp source eq 50080
object service AutoprovS
service tcp source eq 50081
object service VOIP
service udp source eq sip
object service VOIPS
service tcp source eq 5061
object service XMPP
service tcp source eq 5222
object network Starface
host 192.168.100.10
access-list inbound extended permit udp any host 192.168.100.10 range 10000 20000
access-list inbound extended permit tcp any host 192.168.100.10 eq 50080
access-list inbound extended permit tcp any host 192.168.100.10 eq 50081
access-list inbound extended permit udp any host 192.168.100.10 eq 5060
access-list inbound extended permit tcp any host 192.168.100.10 eq 5061
access-list inbound extended permit tcp any host 192.168.100.10 eq 5222
!
object network Starface
nat (inside,outside) static interface service tcp 50080 50080
!
nat (inside,outside) after-auto source dynamic any interface
______________
Is this correct so far? I will be able to test it tomorrow.
But i already struggle with the other nat rules.
object network Starface
nat (inside,outside) static interface service tcp 50080 50080
nat (inside,outside) static interface service tcp 50081 50081
This leads to a config where only the last setting is present
!
object network Starface
nat (inside,outside) static interface service tcp 50081 50081
!
And i cannot configure the port range here
object network Starface
nat (inside,outside) static interface service udp RTP-Daten RTP-Daten
^
ERROR: % Invalid input detected at '^' marker.
What am i doing wrong? And i read that i need to add "access-group inbound in interface outside" is that correct?
Thanks in advance
