0

Below is the config. The port redirection is working, but the range of the ports and other ports permitted in the access-list are not opening:

object network TEST_PUBLIC_IP

host 10.10.10.10

object-group service PROD_101 tcp
port-object eq 8443
port-object eq 922
port-object eq ssh
port-object eq https
port-object range 8000 8200

object network TEST_PRIVATE_IP

host 1.1.1.1.
nat (PRODUCTION,OUTSIDE) static TEST_PUBLIC_IP service tcp 8085 www

access-list Outside_IN extended permit tcp any object TEST_PRIVATE_IP object-group PROD_101

access-group Outside_IN in interface outside
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 15, 2017 at 1:04

1 Answer 1

Reset to default
2

With the ASA code 8.3+, you need to specify the real IP address and the real port in the inbound outside access list. Based on the configuration you provided, if you add:

object-group service PROD_101 tcp
port-object eq www

It should fix your problem.

EDIT: Working configuration for the other ports

object service TCP-SOURCE-22 
 service tcp source eq 22 

nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-22 TCP-SOURCE-22 

object service TCP-SOURCE-8000_8200 
 service tcp source range 8000 8200 

nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-8000_8200 TCP-SOURCE-8000_8200
Improve this answer
5
  • Thanks Josh,The redirection from www of the domain name to port 8085 is working perfectly. However, the challenge i have is that i cannot ssh into the server and also the port range 8000 8200 are not opening.
    – user30017
    Aug 29, 2016 at 9:59
  • Does the entire 8000-8200 range need to be forwarded to port 80 on the 10.10.10.10 server? Also are the other ports listed in your service group changed upon translation? Let me know and I will write up the NAT statements.
    – josh13564
    Aug 29, 2016 at 16:32
  • Thanks so much Josh, someone assisted with solution that resolved the challenge. He designed NAT for both SSH and port ranges. Its working perfectly....Thanks so much for taken your time to read and get back to me.
    – user30017
    Aug 30, 2016 at 12:36
  • Not a problem. If you want I can include the NAT statements in the answer to help someone else if they come across this.
    – josh13564
    Aug 30, 2016 at 17:43
  • Ok... Below is the config that i added that worked for both ssh and port range access to the server. object service TCP-SOURCE-22 service tcp source eq 22 nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-22 TCP-SOURCE-22 object service TCP-SOURCE-8000_8200 service tcp source range 8000 8200 nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-8000_8200 TCP-SOURCE-8000_8200
    – user30017
    Aug 31, 2016 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.