Cannot get Port Forwarding to Work on ASA 5506

[TyraMara]

I have an older model ASA 5506 that I'm trying to get port forwarding working on.

I'm connecting to the 5506 via ASDM 7.10, which I know is a bit old, but that's what we have, at the moment.

In Under Firewall > Access Rules > Outside I have the following setup, line 17 is the one that I'm trying to get working but cannot.  What am I missing?  Note that I am hitting the "apply" button after I put the rule in.  The fact that there are zero "hits" tells me that the firewall isn't allowing this rule for some reason.

[MHM Cisco World]

do packet-tracer using same source and destination and see if it hit any ACL before this ACL.

[balaji.bandi]

what ASA  code running, some old versions of ASA the hit count not stable as new versions, so I will be not replied on that hit counts,

I will open a Real-time Monitor and test it - is that request coming in. Make sure you have any NAT involved, port forwarding, and  ACL in place to allow the required destination.

some example :

https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/118996-config-asa-00.html

https://www.petenetlive.com/KB/Article/0000077

[TyraMara]

I'm new to this system, so I may not know what to look for.

@MHM Cisco World ,

I've never worked with Packet Tracer before.  Looking at this tool, it seems to identify how a packet will travel given an established criteria.

So this is what I did for my test:

• I turned on this rule:

Then I started an instance of Packet Tracer and ran it as noted.,  The IP address here is the TS server.

So, here we have a failure, it can't get to that port for some reason.

Changing the source to be my remote home office and keeping the destination as the location for the TS server, I get the following results:

Looking at the NAT rules after clicking on the link, the 7th rule was highlighted.

I'm not sure what it is about that rule that would cause a denial here.

[MHM Cisco World]

from packet-tracer you need static PAT for your Server TCP port 3389.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html

[TyraMara]

@MHM Cisco World , I don't think I understand what you're saying.  If I'm reading you correctly, the packet tracer didn't work correctly because I didn't configure the ports correctly?  I don't think I'm correct, but I'm not sure what else to think here.

Would you clarify for me, please?

[MHM Cisco World]

from packet-tracer rpf-check make packet drop, what is rpf-check?
it check the NAT of packet inbound with NAT of packet Outbound.

so are you config static PAT for this server ?

[TyraMara]

@MHM Cisco World ,

OK, I think I understand a little bit better.  Basically, I've configured the inbound leg so that traffic from any IP on port 3389 should hit my TS server, but I don't have that set up on the outbound leg?

Regarding static PAT, 

I have a section in the router's UI called "Public Servers."  The TS server is not defined here.  So what I just now did is that I added this server in Firewall > Public Servers.  I set this as follows.  Note that if I click "Specify Public Service if different from Private Service.  This will enable the static PAT, I CANNOT add RDP as the public service.

I cannot add a public server because the IP address that we need to use for RDP is the same as the public interface address.  The UI balks at me when I try to do this:

Not sure if this is relevant right off, but I see in Firewall > Objects > Service Objects/Groups that there are a couple of objects that might be relevant to our situation:

So, I think the answer to your question is no.  I do not have static PAT for this server, and the UI won't allow me to set this up.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113425-asdm-pub-server-00.html

check this like