3

I am trying to setup simple RDP rule from outside TEST_IPs to inside server 192.168.1.5 LLDHH-ADC. I configured nat and access list but I am not able to RDP to the server. I am new to ASA world and any help will be appreciated.

Here is part of my config:

object network LLDHH-ADC
 host 192.168.1.5

object network LLDHH-ADC
 nat (inside,outside) static interface service tcp 3389 3389

nat (any,outside) after-auto source dynamic any interface

access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC

On the server while trying to RDP I am getting:

C:\Users\Administrator>netstat -an | find ":3389"
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING

  TCP    192.168.1.5:3389       38.122.xx.xx:2763     ESTABLISHED

  TCP    [::]:3389              [::]:0                 LISTENING

On the ASA I am getting the following output:

6    May 07 2014    19:56:52    302013    38.122.xx.xx    2763    192.168.1.5 3389 
  Built inbound TCP connection 8341440 for outside:38.122.xx.xx/2763 
  (38.122.xx.xx/2763) to inside:192.168.1.5/3389 (50.204.xx.xx/3389)

and after RDP fails:

6    May 07 2014    19:57:52    302014    38.122.xx.xx    2763    192.168.1.5 3389
  Teardown TCP connection 8341440 for outside:38.122.xx.xx/2763 to 
  inside:192.168.1.5/3389 duration 0:01:00 bytes 19 TCP Reset-I
3

If you only have a single subnet behind the firewall, I would try something like this.

object network inside-net
subnet 192.168.1.0 255.255.255.0
nat(inside,outside) dynamic interface dns

You would then be able to remove this.

nat (any,outside) after-auto source dynamic any interface

I prefer to be explicit with the PAT rule.

Instead of this ACL:

access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC

Try this:

access-list outside_access extended permit tcp object-group TEST_IPs object LLDHH-ADC eq 3389

This NAT rule looks good.

object network LLDHH-ADC
 nat (inside,outside) static interface service tcp 3389 3389
  • Thank you. I will try this during the off hours and let you know if it works. – user4608 May 8 '14 at 13:13
  • Yes, please let me know how this works out. – James.Birmingham May 9 '14 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.