08-17-2016 11:51 PM - edited 03-12-2019 01:08 AM
Hello all,
I am running ASA 5525-X 9.6(1)
I have a machine on inside with ip 172.16.X.250 which want to host multiple services (i.e. http, https, ssh, ftp) to be accessed from outside via 121.x.x.y
just want to know if I can use object-group service to gather and allow all services above in a single static nat command
I want a configuration that might look somewhat similar to following.
OPTION-1
----------------
object-group service GPS-ENV-VL43
service-object tcp-udp destination eq www
service-object tcp destination eq https
service-object tcp destination eq ftp
service-object tcp destination eq ssh
exit
object network 172.16.X.250_ENV_GPS_LOCAL
host 172.16.X.250
nat (inside,outside) static 121.x.x.y service GPS-ENV-VL43 GPS-ENV-VL43 (not able to use service object-group)
OPTION-2
----------------
object-group service GPS-ENV-VL43
service-object tcp-udp destination eq www
service-object tcp destination eq https
service-object tcp destination eq ftp
service-object tcp destination eq ssh
exit
object network 172.16.x.250_ENV_GPS_LOCAL
host 172.16.43.250
exit
object network 121.x.x.y_ENV_GPS_GLOBAL
host 121.x.x.y
exit
nat (inside,outside) source static 172.16.x.250_ENV_GPS_LOCAL 121.x.x.x_ENV_GPS_GLOBAL service GPS-ENV-VL43 GPS-ENV-VL43 (unable to use object-group services here)
08-18-2016 04:48 PM
object service SERVER_SOURCE_PORTS
service tcp source range 21 53
2. Create an object group for the translated ports. This will be the ports you wish the ASA to use to connect to the device on the inside or DMZ of your network. In my example, I've just done the same ports.
object service SERVER_PORTS_XLATE
service tcp source range 21 53
object network SERVER_OUTSIDE
host 10.1.1.1
object network SERVER_OUTSIDE
host 10.2.2.2
4. Lastly, tie this all together with something similar to the following NAT statement.
nat (inside,outside) source static SERVER_INSIDE SERVER_OUTSIDE service SERVER_SOURCE_PORTS SERVER_PORTS_XLATE
08-18-2016 09:22 PM
Luke Oxley thanks for the reply, however it didn't work, see my config and error in the end
object-group service GPS-ENV-VL43-PORTS
service tcp source eq http
service tcp source eq https
service tcp source eq ftp
service tcp source eq ssh
exit
object-group service GPS-ENV-XLATE
service tcp source eq http
service tcp source eq https
service tcp source eq ftp
service tcp source eq ssh
exit
object network GPS-ENV-LOCAL
host 172.16.X.250
object network GPS-ENV-GLOBAL
host 121.X.X.Y
MUET -EDGE-FW(config)# nat (inside,outside) source static GPS-ENV-LOCAL GPS-ENV-GLOBAL service GPS-ENV-VL43-PORTS GPS-ENV-XLATE
ERROR: GPS-ENV-VL43-PORTS is not a valid service object name (I believe it accepts service object only and not the service object-group )
Regards
08-19-2016 05:32 AM
08-23-2016 09:12 PM
Dear Luke Oxley,
When you create service object and hit multiple ports under it, you end up with only last command left, see the following example.
FW(config)# object service GPS-ENV-XLATE
FW(config-service-object)# service tcp source eq http
FW(config-service-object)# service tcp source eq https
FW(config-service-object)# service tcp source eq ftp
FW(config-service-object)# service tcp source eq ssh
FW(config-service-object)#
FW(config-service-object)# exit
FW# sh run object service
object service GPS-ENV-XLATE
service tcp source eq ssh
FW#
Also note that the ports I am trying to create object services for, are not continuous or contiguous, they are random ports.
08-26-2016 10:32 AM
09-30-2024 01:08 PM
Was there ever a resolution to this? I'm running into the same thing. I would like to clean up some NAT statements by condensing them down.
09-30-2024 01:11 PM
Make new post
MHM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide