3

I've been beating my head against this for a while now and I've tried all links I could find that were even the least bit relevant to my situation. Any and all information is greatly appreciated.

What I am trying to do is forward 3 ports using TCP & UDP protocols on my ASA5505 running OS 9.0 to a server on the inside. Its a flat network on the inside also.

Server address: 10.10.10.10

Ports: 8080 TCP&UDP 9090 TCP&UDP 9191 TCP&UDP

Edit The config works fine.

Here is what I have so far

ASA Version 9.0(1)
!
hostname XXX
domain-name domain.local
enable password XXX encrypted
passwd XXX encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.10.10.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 40.40.40.10 255.255.255.0
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 8.8.8.8
 name-server 8.8.4.4
 domain-name domain.local
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network SVR
 host 10.10.10.10
object service tcp-8080
 service tcp source eq 8080
object service tcp-9090
 service tcp source eq 9090
object service tcp-9191
 service tcp source eq 9191
object service udp-8080
 service udp source eq 8080
object service udp-9090
 service udp source eq 9090
object service udp-9191
 service udp source eq 9191
access-list 100 extended permit icmp any any echo-reply
access-list 100 extended permit tcp any object SVR eq 8080
access-list 100 extended permit tcp any object SVR eq 9090
access-list 100 extended permit tcp any object SVR eq 9191
access-list 100 extended permit udp any object SVR eq 8080
access-list 100 extended permit udp any object SVR eq 9090
access-list 100 extended permit udp any object SVR eq 9191
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static SVR interface service tcp-8080 tcp-8080
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
nat (inside,outside) source static SVR interface service tcp-9191 tcp-9191
nat (inside,outside) source static SVR interface service udp-8080 udp-8080
nat (inside,outside) source static SVR interface service udp-9090 udp-9090
nat (inside,outside) source static SVR interface service udp-9191 udp-9191
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 40.40.40.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet 10.10.10.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside

dhcpd address 10.10.10.230-10.10.10.240 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 0.0.0.0
username XXX password XXX encrypted privilege 15
!
!
prompt hostname context
no call-home reporting anonymous
: end 

Result of trace

XXX# packet-tracer input outside tcp 8.8.8.8 3456 40.40.40.10 9090

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:
NAT divert to egress interface inside
Untranslate 40.40.40.10/9090 to 10.10.10.10/9090

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group 100 in interface outside
access-list 100 extended permit tcp any object SVR eq 9090
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:
Static translate 8.8.8.8/3456 to 8.8.8.8/3456

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:

Phase: 9
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 370, packet dispatched to next module

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
  • Hello, could you please provide the output of the following packet-tracer: packet-tracer input outside tcp 8.8.8.8 3456 40.40.40.10 8080 – Brett Lykins Aug 21 '17 at 16:10
  • Thank you for the quick response, I've updated the initial question with the trace query. – rb88 Aug 21 '17 at 16:28
  • Which license you have on your firewall?please attach the output of show version – Mr.lock Aug 21 '17 at 17:51
  • So @rb88 based on your packet-tracer output, this is functioning as needed. Are you familiar with the packet capture commands on the ASA? I would attempt to reach one of those ports from a known IP on the internet and do a capture of it like so: capture 8080_cap interface inside match tcp any host 10.10.10.10 eq 8080 Then you can do show capture 8080_cap to look at the contents. It appears to be getting through the ASA, as packet-tracer does not usually lie. – Brett Lykins Aug 21 '17 at 18:35
  • I found the issue and it was not in the configuration of the firewall! The configuration above seems to work just fine. Thank you all again for your input. – rb88 Aug 21 '17 at 18:38
-1

One way is in the gui. Go to configuration at the top, click firewall at the bottom left and select public server in the list. Click add on the right. Choose your public and private interface, ip addresses and ports. The ASA will build the NATand ACLs for you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.