VPN , DMZ services port forwarding ASA

Question

Hey i am a bit confused about port forwarding and how is suppose to work.

In the lab , i set up VPN access to the outside interface and that works find. Users contacting the outside interface of ASA with ip 10.177.5.40 are prompted to download cisco any connect etc. This is done when a user types the ip in the browser and automatically gets redirected to a https page. port 443

Now i want users from the outside to have access to my DMZ server services HTTP and FTP. Users by typing the http: //10.177.5.40 or ftp: //10.177.5.40 to get access to dmz services. Is it possible or i have to use another ip like 10.177.5.41 .

After watching tutorials for some hours now i have to admit i am more confused that before :)

Answer 1

Clients can download the software vpn client only if they access the ip via https port 443, i.e. https://10.177.5.40, unless there is automatic redirection from http to https at the client.

Therefore ports 80 http and ftp on the same ip address are free for you to use, take a look at the section: Single Address for FTP, HTTP, and SMTP (Static NAT-with-Port-Translation) in Cisco ASA Firewall configuration guide.

http://www.cisco.com/en/US/docs/security/asa/asa91/asdm71/firewall/nat_objects.html#wpxref67001

Answer 2

You can do a static PAT (Port Address Translation) to forward specific ports for an IP (including the ASA's interface IP) to different internal devices. You can do this for any port, but each port can only be forwarded to one internal device using a static PAT statement. For example, assuming you have something like:

interface Ethernet0/2
 nameif dmz
 ip address 192.168.99.0 255.255.255.0
 security-level 50

Then you will create an object for your DMZ host and use a static "nat" statement with the service keyword to create a port-level static PAT for your object, like so:

object network DMZHOST
 host 192.168.99.10
 nat (dmz,outside) static interface service tcp ftp ftp

Your DMZ host will now be accessible at ftp: //10.177.5.40. This is well documented in the Cisco ASA Configuration Guide.

If you're using AnyConnect running on TCP 443 (the HTTPS) port, then you cannot static PAT that to another internal/DMZ host or else you'll break AnyConnect. In that case, you can run AnyConnect on a different port:

webvpn
 port 8443

In this way, your AnyConnect would be accessible at https: //10.177.5.40:8443. Or you can NAT a different external port to port 443 on your internal host, like this:

object network DMZHOST
 host 192.168.99.10
 nat (dmz,outside) static interface service tcp 443 8443

This would make your DMZ host accessible at https: //10.177.5.40:8443, but your web server on the host itself would continue to run on port 443.