1

I'm sure there's answers to this all over the internet but I've tried for days and days and I just can't get it. Maybe I'm cisco dyslexic.

I have a simple home connection and lets say my external web ip address is 1.2.3.4, and inside my asa5505 network I've got a web server running in a VM which I want to expose to the internet for HTTPS and RDP. Lets say the internal IP of that server is 10.0.0.98

The rest of the network is on a domain but this webserver is not joined to the domain and I've enabled windows firewall.

Since its a VM I can't plug it into a separate port on the ASA5505.

What commands can I issue to the 5505 to safely expose HTTPS and RDP for just that machine, while keeping the rest of the network safe and without disabling vpn which is needed for home workers?

Help about in asdm gives: Cisco Adaptive Security Appliance Software Version 8.3(1) Device Manager Version 6.3(1)

TIA

Improve this question
5
  • BTW I only have one web facing IP address available, so when someone visits it with https ://1.2.3.4 I want it to route to that server, but anything else like VPN I still want it to work as it was before :--)
    – user2728841
    Jun 29, 2016 at 9:15
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 18:37
  • Yes I'm not sure what to do here. In the end we bought a different router because we don't want to become cisco experts and we didn't want to risk exposing the network as a result of not being cisco experts. So instead we purchased a router that is easy to configure. That means we didn't get to try the answers proposed.
    – user2728841
    Aug 15, 2017 at 11:07
  • OK. You could provide you own answer that says that, and accept it. The question will then become part of the archive for people to find, along with the answers.
    – Ron Maupin ♦
    Aug 15, 2017 at 15:19
  • I've accepted what seemed like the best answer, but I am grateful for all attempts to answer. I didn't think my solution was particularly helpful, it just happened to be best for us at the time in some fairly unusual circumstances.
    – user2728841
    Aug 15, 2017 at 19:03

4 Answers 4

Reset to default
1

I'd highly recommend using asdm if you are newer to cisco pix rules and ASA configuration. The process can be pretty simple....As mentioned make sure to create a NAT rule on the ASA to allow for the traffic, then nest this web server object in a group with very specific rules which will allow the desired traffic and not allow the undesired. There is also a feature built into asdm which will allow you to test the traffic flow once the rules are in place. It will go through the hops necessary and give you a go or no go =). High level summary but good luck, and if necessary holler and maybe I can be more specific.

Improve this answer
3
  • Thanks for this. I've now ordered a separate switch to put in front of the ASA5505 and I'm going to put the web server directly on that, with just windows firewall. Not ideal but it will do for now. I'm still going to follow the suggestions in here in the hope of getting it working and also learning something along the way! thanks
    – user2728841
    Jun 30, 2016 at 10:58
  • Why dont you just DMZ the VM behind the ASA like it should be =). It isnt that much more difficult and the bonus is you will learn something in the process. Ill braoch this again when I return from my errands in a short bit. There is definitely an easy and viable solution for this issue.
    – Ty Smith
    Jun 30, 2016 at 22:27
  • Yes you're probably right, but I'm really scared of leaving something open that I didn't intend to, thus exposing our network, the router option just seemed safer. That said I'll still give it a go though
    – user2728841
    Jul 1, 2016 at 11:33
0

The most basic answer resides in NAT. You have to NAT your outside HTTPS and RDP ports to the inside host address of your server. You'll also have to have a rule allowing all IPs from outside to the inside host address on your HTTPS port.

I'd highly recommend NOT having RDP open to the internet however.

The answer is different depending on whether you are using ASDM or CLI however, the following Cisco TAC document should point you in the right direction:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html

Improve this answer
2
  • Thanks, like so many articles, that one expects there to be a DMZ where the DMZ server(s) are wired to a specific port. That isn't the case here (because the server is a VM and its host is within the internal network). I'm hugely a noob at cisco pix commands so I really need someone to spoon feed me the instructions !
    – user2728841
    Jun 29, 2016 at 11:54
  • BTW I don't mind using asdm or cli !
    – user2728841
    Jun 29, 2016 at 11:56
0

This is a Visio of one of the environments I worked in about a year ago. Maybe it will give you some insight seeing it on paper, or help you cook up some ideas for a solution.

Simple Visio with multiple ASA firewalls and DMZ area with NAT and no NAT. Hope this helps, This is an actual production environment.

Improve this answer
0

ASA Port Forwarding

interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 198.51.100.100 255.255.255.0 // Your Global IP
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!


object network inside-subnet
 subnet 192.168.0.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network webserver
 host 192.168.0.100
 nat (inside,outside) static webserver-external-ip service tcp www www

access-list outside_acl_in extended permit tcp any object webserver eq www
!
access-group outside_acl_in in interface outside

route outside 0.0.0.0 0.0.0.0 198.51.100.1 //your ISP Gateway
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.