3

I am having trouble setting up RDP access from outside the network using a custom port. I would like for port 5000 to be translated externally to 3389 internally. I have set it up with the commands below but I can't get RDP to work externally using port 5000.

I am using an ASA 5505 version 9.2 with ASDM version 7.8(1)

object network Internal_RDP_Server-1
 host 192.168.50.99
 nat (inside,outside) static interface service tcp 3389 5000 


access-list inbound permit tcp any object Internal_RDP_Server-1 eq 5000

access-group inbound in interface outside

Any help would be much appreciated!

Improve this question
3
  • I think you need a nat statement the point the external ip and port to the internal ip and port. In older asa it was like 'static (inside,outside) tcp 69.x.x.x 5000 192.168.50.99 3389 netmask 255.255.255.255'
    – Fixitrod
    Commented Aug 22, 2017 at 17:03
  • Thanks. Would you know the exact syntax of the statement. I am familiar with the pre-8.3 commands but not so much with the newer ones.
    – Michael
    Commented Aug 28, 2017 at 12:32
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 21, 2018 at 16:32

2 Answers 2

Reset to default
1

I've seen two variations of this command. The one you have done and the following

object network obj_192.168.50.99
 host 192.168.50.99
nat (inside,outside) static <-External IP Address-> service tcp 3389 5000

The difference is we've replaced the word "interface" with the real world external IP address.

Improve this answer
1 
 nat (inside,outside) static interface service tcp 3389 5000

This line is correct if you mean to map requests to the OUTSIDE interface's IP address on port 5000 to the 192.168.50.99 IP address on port 3389.

access-list inbound permit tcp any object Internal_RDP_Server-1 eq 5000

This line, however is incorrect. 8.3+ ASA ACL syntax expects you to use the real attributes in all cases. You are specifying eq 5000, which is in fact the mapped attribute.

It should look like this:

access-list inbound permit tcp any object Internal_RDP_Server-1 eq 3389
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.