Hi all, I've recently bought a Cisco ASA 5520 on eBay for study and I've decided to use it solely as a firewall between my home LAN and the Internet. Wow, what a learning curve! I've managed to add my internal networks as objects and create a NAT rule (thanks for youtube) to PAT my internal devices to get out to the Internet with ASDM but I'm really struggling to do the following: - - allow any incoming traffic that hits the external facing interface destined for port 38921 and nat to 10.1.10.101:38921 - allow any incoming traffic that hits the external facing interface destined for port 30392 and nat to 10.1.10.101:30392 Can anyone guide me on how to do this, as I have a couple of services running behind these ports on a server that I want to get at when I'm not at home? My (rather messy) config is as follows: - hostname FW1 enable password encrypted passwd encrypted names ! interface GigabitEthernet0/0 description **External facing to Internet** nameif Outside security-level 0 ip address dhcp setroute ! interface GigabitEthernet0/1 description **Internal Facing to 3750** nameif Internal security-level 100 ip address 10.1.10.2 255.255.255.0 ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 ! ftp mode passive object network VLAN1 subnet 192.168.1.0 255.255.255.0 description Legacy object network WiredLAN subnet 10.1.10.0 255.255.255.0 description Wired LAN object network CorporateWifi subnet 10.1.160.0 255.255.255.0 description Corporate Wireless VLAN 160 object network GuestWifi subnet 10.1.165.0 255.255.255.0 description Guest Wireless VLAN 165 object network LegacyLAN subnet 192.168.1.0 255.255.255.0 description Legacy LAN in place until change over object network FileServer host 10.1.10.101 description File Server object service Service1 service tcp source eq 38921 destination eq 38921 description 1st service object-group network All_Inside_Networks network-object object VLAN1 network-object object WiredLAN network-object object CorporateWifi network-object object GuestWifi network-object object LegacyLAN object-group service Service2 tcp-udp port-object eq 30392 object-group service DM_INLINE_TCPUDP_1 tcp-udp port-object eq 30392 group-object Service2 object-group protocol TCPUDP protocol-object udp protocol-object tcp access-list Outside_access_in extended permit object-group TCPUDP any object FileServer object-group DM_INLINE_TCPUDP_1 inactive access-list Outside_access_in extended permit object Service1 any object FileServer inactive pager lines 24 logging enable logging asdm informational mtu Outside 1500 mtu Internal 1500 mtu management 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-714.bin no asdm history enable arp timeout 14400 nat (Internal,Outside) source dynamic FileServer interface service Service1 Service1 inactive nat (any,Outside) source dynamic All_Inside_Networks interface access-group Outside_access_in in interface Outside route Internal 10.1.160.0 255.255.255.0 10.1.10.1 1 route Internal 10.1.165.0 255.255.255.0 10.1.10.1 1 route Internal 192.168.1.0 255.255.255.0 10.1.10.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.1.160.15 255.255.255.255 Internal no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.1.160.15 255.255.255.255 Internal telnet timeout 5 ssh timeout 5 console timeout 0 dhcp-client client-id interface Outside dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username Barry password encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:19be38edefe8c3fd05e720aedee62c8e : end ... View more

Hi everyone, I've been hunting around the web trying to find out why virtual fragmentation reassembly is automatically configured on interfaces that are configured for NAT but have been unable to find a solid answer. I've speculated it might be because non-initial fragments wouldn't be able to be translated due to the missing layer 4 information but I've not been able to have that confirmed. Does anybody have a definite answer? Thanks, Barry ... View more