Port Forwarding on Cisco ASA 5500

[tonyk0001]

Hi team,

I am using CISCO ASA5555 as my Internet Gateway with only one ISP (One Public IP).

Everything is working Ok but I want to access my Camera system on the internet using ports HTTP:80, RTSP:554,Server port:8000, HTTPS:443.

I have tried some commands but none seems to work.

Kindly advise on how to proceed.

Regards

[Rahul Govindan]

You would have to create port forwarding rules for each of the services as given in this doc:

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/118996-config-asa-00.html#anc10

Instead of a separate public ip address used in this doc, use the "interface" keyword to forward traffic that comes in to your public ip address. Another doc that uses the ASA public interface is here:

http://www.petenetlive.com/KB/Article/0000077

[tonyk0001]

Hi Rahul,

That is understandable and I already configured the natting for the LAN network to access the internet on the interface (outside to be specific).

My concern is, If I do the same for the forwarding, Wont the Access-list and the natting for the port forwarding interfere with the ones I created prior (For the LAN internet access)

[Rahul Govindan · Accepted solution]

That would not be affected. What happens is that the ASA reserves only the ports (not the entire public ip address) that is used for port forwarding and does not re-use them for your dynamic NAT.

For example, internet traffic initiated from your lan to the internet will have source port as 50000 and destination port as 443. The ASA uses the dynamic translation to change source port to 60000 for example. Return traffic matches the built connection and comes back to the user.

Portforwarding traffic is initiated from m an internet client on say port 55000 to public ip address on port 443. The ASA changes the destination ip address to your camera server and sends it in. There should not be any conflict between the dynamic PAT and Port forwarding NAT rule.

[tonyk0001]

Hi Rahul, Thanks alot. So in this case I guess I should use port forwarding with NAT.