Port forwarding on ASA 5510

[neillradford]

Hi all

Have ran into an issue on my ASA 5510.

I have recently added a web server to directly into Ethernet port 2 on the ASA. It will be accessed from the internet so as a result, is on its own dedicated interface, separate from the internal network. I need this web server to listen on ports 2008-2011 and 1957-1960 to pull down feeds from a remote server configured to send on the same ports. I then need my ASA to be clever enough to forward this particular traffic onto the internal web server. Sounds simple enough but running into a brick wall with the NAT statements and Access Rules! If anyone can help, I will post selected config and the results of the packet trace (which show its almost there!).

Thanks :)

[Pranay Prasoon]

NAT and access-list on ASA depends on version on software. Please post software version.
 

[neillradford]

Hi Pranay,

Thanks for the quick reply.

asdm-731-101
asa 9.1(5)

See attached for selected config. I've tried so many variants of NAT so doubt this current config is correct.

Thanks

N

[Pranay Prasoon]

You have access-list at ingress direction on "outside" and "egress" on Headend

You need to allow traffic on both of them to 10.10.100.0/24 from outside address. Have you verified if correct access-list is configured?

[neillradford]

Hi Pranay

I have changed it around but still the packet trace fails at same point?

Thanks

N

[Pranay Prasoon · Accepted solution]

please add these two lines and let me know

access-list outside_access_in line 1 permit ip any 10.10.100.0 255.255.255.0

access-list HeadEnd  line 1 permit ip any 10.10.100.0 255.255.255.0

If it doesn't work, please send me packet-tracer output again with command.

[neillradford]

That worked! Just need to add the rest of the NAT statements.

Many thanks

[Pranay Prasoon]

You have access-list at ingress direction on "outside" and "egress" on Headend

You need to allow traffic on both of them to 10.10.100.0/24 from outside address. Have you verified if correct access-list is configured?

[Jon Marshall]

I think looking at your configuration the acls applied to the HeadEnd interface are the wrong way round.

So the inbound acl on that interface is traffic coming from the web server.

The outbound acl on that interface is traffic going to the web server.

So your source and destination IPs are the wrong way round as far as I can tell.

Whether you actually need either of the acls is debatable.

The inbound acl would be needed if you either -

1) wanted to allow the web server access to higher security interfaces eg. your inside interface

or

2) you wanted to restrict what connections can be initiated from the web server to the outside

and the outbound acl would be needed if  you wanted to limit what traffic is allowed to the web server from other interfaces other than the outside because you have an acl already on the outside interface.

So I'm not sure you need either although it's difficult to say.

Most common are inbound acls which you may need depending on the above.

Jon

[neillradford]

Hi Jon

Thanks for taking the time to read my config and reply.

I had intended to restrict access to the web server to only permit access from the outside to 6 ports so maybe I am going overboard with the ACLs. I have an access group applied to the interface as well.

This interface doesn't need access to the inside network at all, just internet access outbound.

The packet trace does indicate an ACL issue so will swap the source & destination round as suggested.

Thanks

Neill

[neillradford]

Swapped the source and destination around but still no luck :(