ASA 5505 CLI Port Fowarding

josealbertodiazg1 · ‎08-27-2015

Hi to all the community, I have Instant messaging service installed that uses port XXXX need to do a port fowarding in my ASA-5505

I have created the network object pointing to a fixed IP 192.168.1.5/24

object-group network IM-COM
description IM-Server
network-object host 192.168.1.5

Create

object-group service IM_PORTS
service-object tcp eq XXXX

My ACL

access-list IM-COM extended permit tcp any host 192.168.1.5 eq XXXX

and NAT rule

static (outside,inside) 192.168.1.5 [External IP] netmask 255.255.255.255

But I can't get my phone yet get connected over the Internet, please I could use some help with this matter thanks to all for reading this

Jon Marshall · ‎08-27-2015

Which version of code are you using ?

Assuming 8.2 or earlier by the looks of your static NAT -

1) the acl should reference the public IP not the private IP

2) change your static statement to -

static (inside,outside) <external IP> 192.168.1.5 netmask 255.255.255.255

note if you want to use the same external IP for other port translations then you can do -

static (inside,outside) tcp <external IP> <port number> 192.168.1.5 <port number> netmask 255.255.255.255

Up to you.

If you are running 8.3 or later code then please say as the above won't work.

Jon

josealbertodiazg1 · ‎08-27-2015

I'm Using the ASA 8.2 try the code but din'd work saids:

Firewall(config)# static (inside,outside) tcp [Public IP] [XXXX] [local IP] [XXXX] netmask 255.255.255.255
ERROR: Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address

I already fix the ACL Im checking the static route

Just try

static (inside,outside) tcp interface XXXX 192.168.1.5 XXXX netmask 255.255.255.255

from this discussion

https://supportforums.cisco.com/discussion/10391761/static-entry-asa

Didn't work either

Thanks a lot for your time

Jon Marshall · ‎08-27-2015

Yes, if the public IP is the interface IP you need to use the "interface" keyword which you worked out.

Are you sure you have allowed all the necessary ports ?

Can you post your current configuration.

Jon

josealbertodiazg1 · ‎08-27-2015

I just open in the ACL

access-list IM_COM extended permit tcp any host [Public_ IP] range XXXX YYYY

and static to

static (inside,outside) tcp interface 5222 192.168.1.5 XXXX netmask 255.255.255.255

I know of two ports only that need to be open 5222 and 7777; I know I can reach the ASA5505 because I have a ping so any Ideas please?? Thanks a lot for taking so much time for me truly J. Hopefully this will help once again thanks.

interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address [Public IP] [Netmask]

object-group service IM_PORTS
service-object tcp eq 5222
object-group network IM-COM
description IM-Server
network-object host 192.168.1.5
access-list IM_COM extended permit tcp any host [public_ip] range 5221 10015
pager lines 24
logging enable
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5222 192.168.1.5 5222 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 [*******************] 1

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL

Jon Marshall · ‎08-27-2015

Have you added statics for both ports ?

If you have based on what you have posted it looks fine.

You could try running a packet tracer to see what the firewall is doing ie.

"packet-tracer input outside tcp 8.8.8.8 12345 <public IP> 5222"

and post the results.

Jon

josealbertodiazg1 · ‎08-27-2015

I just came in the datacenter I have a COMCAST Modem facing the internet an my firewall behind him, tomorrow I'll check the modem ports to see if they're closed. Im like a week old here so Im sorry for this anyway Im not going to close the discussion yet. I'm very gratefull for all.see you guys tomorrow.J

Could you please clarify for me about

Have you added statics for both ports ?

you mean for inside and outside? I have only one static the one you see in the conf.

josealbertodiazg1 · ‎09-08-2015

I'm sorry It took me sometime, to reply but the COMCAST Modem well was a mess in the internal LAN, now it's fin and I'm getting he firewall from both sides, for some reason it's droping the packets here I paste the results of the packet-tracer any help deeply appreciated, it's the ASA ver 8.2(5)

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Sh run

!
ftp mode passive
object-group network IM-COM
description IM-COM Server
network-object host 192.168.1.5
access-list IM extended permit tcp any host [public IP] range 5221 10015
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5222 192.168.1.5 5222 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 10.1.10.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000