2

Am dealing ASA first time.

I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on Cisco ASA 5512?

Edit:

am going to place the server inside.

i have this access list in my firewall

access-list broadband extended permit ip X.0.0.0 255.0.0.0 any

I need to update the application from outside.

Improve this question
2
  • 1
    We need a little more information. Where is the server in relation to the firewall? Are you opening ports from the outside? Please edit your post to include the firewall configuration.
    – Ron Trunk
    Jul 25, 2016 at 11:15
  • OK, HTTP is TCP port 80, HTTPS is TCP port 443... but we also need to know what port you're using for SSL (is it TCP port 22 for SSH and SFTP?), and which TCP and UDP ports you want allowed. I'm assuming (maybe unfairly?) that you would like something more specific than just permitting any IP traffic from the outside world to your network?
    – Nanban Jim
    Jul 25, 2016 at 17:29

1 Answer 1

Reset to default
4

You need to configure Access Rules. Below is an example to get you started. You need to build yours to suit your needs.

hostname(config)# access-list outside_access extended permit tcp any object inside-server1 eq www
hostname(config)# access-group outside_access in interface outside

CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.6

Controlling Network Access Access rules determine which traffic is allowed through the ASA. There are several different layers of rules that work together to implement your access control policy:

  • Extended access rules (Layer 3+ traffic) assigned to interfaces—You can apply separate rule sets (ACLs) in the inbound and outbound directions. An extended access rule permits or denies traffic based on the source and destination traffic criteria.
  • Extended access rules assigned globally—You can create a single global rule set, which serves as your default access control. The global rules are applied after interface rules.
  • Management access rules (Layer 3+ traffic)—You can apply a single rule set to cover traffic directed at an interface, which would typically be management traffic. In the CLI, these are “control plane” access groups. For ICMP traffic directed at the device, you can alternatively configure ICMP rules.
Improve this answer
1
  • 2
    Since @Tech is new to using ASAs he may also need to know it is necessary to create the appropriate NAT rules in addition to making ACLs to allow the traffic to the server. Depending on his ASA version number the NAT statements may need to point to the private IP address of the server or the public IP address before it is translated to the private IP address of the server.
    – user5870571
    Aug 15, 2016 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.