TCP Reset-I on Cisco ASA 5512x version 9.1

Question

I am trying to setup simple RDP rule from outside TEST_IPs to inside server 192.168.1.5 LLDHH-ADC. I configured nat and access list but I am not able to RDP to the server. I am new to ASA world and any help will be appreciated.

Here is part of my config:

object network LLDHH-ADC
 host 192.168.1.5

object network LLDHH-ADC
 nat (inside,outside) static interface service tcp 3389 3389

nat (any,outside) after-auto source dynamic any interface

access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC

---

On the server while trying to RDP I am getting:

C:\Users\Administrator>netstat -an | find ":3389"
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING

  TCP    192.168.1.5:3389       38.122.xx.xx:2763     ESTABLISHED

  TCP    [::]:3389              [::]:0                 LISTENING

On the ASA I am getting the following output:

6    May 07 2014    19:56:52    302013    38.122.xx.xx    2763    192.168.1.5 3389 
  Built inbound TCP connection 8341440 for outside:38.122.xx.xx/2763 
  (38.122.xx.xx/2763) to inside:192.168.1.5/3389 (50.204.xx.xx/3389)

and after RDP fails:

6    May 07 2014    19:57:52    302014    38.122.xx.xx    2763    192.168.1.5 3389
  Teardown TCP connection 8341440 for outside:38.122.xx.xx/2763 to 
  inside:192.168.1.5/3389 duration 0:01:00 bytes 19 TCP Reset-I

Answer 1

If you only have a single subnet behind the firewall, I would try something like this.

object network inside-net
subnet 192.168.1.0 255.255.255.0
nat(inside,outside) dynamic interface dns

You would then be able to remove this.

nat (any,outside) after-auto source dynamic any interface

I prefer to be explicit with the PAT rule.

Instead of this ACL:

access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC

Try this:

access-list outside_access extended permit tcp object-group TEST_IPs object LLDHH-ADC eq 3389

This NAT rule looks good.

object network LLDHH-ADC
 nat (inside,outside) static interface service tcp 3389 3389