2

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX.

So when i configure by referring other video and articles and only change the ip address, real port and mapped port, is still unable to access to the PBX interface when enter the public ip address. There is no error occur during the configuration.

Below are the Network object i configure

Network Object

192.168.1.168 is the ip address of the PBX

Advance setting of network object

advance setting

This is the inside interface

inside interface

There is also another outside interface using the PPPoX.

output of "show running-config"

ddns update method myupdate
 ddns both
 interval maximum 0 1 0 0
!

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 pppoe client vpdn group A
 ip address pppoe setroute 
!
interface GigabitEthernet1/2
 bridge-group 1
 nameif inside_1
 security-level 100
!
interface GigabitEthernet1/3
 bridge-group 1
 nameif inside_2
 security-level 100
!
interface GigabitEthernet1/4
 bridge-group 1
 nameif inside_3
 security-level 100
!
interface GigabitEthernet1/5
 bridge-group 1
 nameif inside_4
 security-level 100
!
interface GigabitEthernet1/6
 bridge-group 1
 nameif inside_5
 security-level 100
!
interface GigabitEthernet1/7
 bridge-group 1
 nameif inside_6
 security-level 100
!
interface GigabitEthernet1/8
 bridge-group 1
 nameif inside_7
 security-level 100
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
interface BVI1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
ftp mode passive
clock timezone MYT 8
dns domain-lookup outside
dns domain-lookup inside_1
dns domain-lookup inside_2
dns server-group DefaultDNS
 name-server 202.186.88.215 inside
 domain-name autovacbot.ddns.net
same-security-traffic permit inter-interface
object network obj_any1
 subnet 0.0.0.0 0.0.0.0
object network obj_any2
 subnet 0.0.0.0 0.0.0.0
object network obj_any3
 subnet 0.0.0.0 0.0.0.0
object network obj_any4
 subnet 0.0.0.0 0.0.0.0
object network obj_any5
 subnet 0.0.0.0 0.0.0.0
object network obj_any6
 subnet 0.0.0.0 0.0.0.0
object network obj_any7
 subnet 0.0.0.0 0.0.0.0
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network smartrobot_SIP
 host 192.168.1.5
object network smart_robotSIP
 host 192.168.1.6
object network smartrobotsip
 host 192.168.1.168
object network test
 host 202.184.117.252
object network dns
 host 202.186.88.215
object network PBX_insides
 host 192.168.1.168
object-group service smartrobotrtp udp
 description smartrobotrtp
 port-object range 10000 20000
 port-object eq sip
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service smartrobot tcp-udp
 port-object eq sip
object-group service Test tcp-udp
 port-object eq sip
object-group service Dns tcp-udp
 port-object eq domain
 port-object eq echo
access-list 100 extended permit icmp any any 
access-list from_outside extended permit icmp any any echo 
access-list inside_1_access_in extended permit ip any any 
access-list outside_access_in extended permit ip any any 
access-list outside_access_in extended permit object-group TCPUDP any object test object-group Test 
access-list outside_access_in extended permit object-group TCPUDP any object smartrobotsip object-group smartrobot 
access-list outside_access_in extended permit object-group TCPUDP any object dns object-group Dns 
access-list outside_access_in extended permit tcp any object PBX_insides eq 9966 
access-list inside_access_in_2 extended permit ip any any 
pager lines 24
logging enable
logging asdm informational
mtu outside 1492
mtu inside_1 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 1 burst-size 1
asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any1
 nat (inside_1,outside) dynamic interface
object network obj_any2
 nat (inside_2,outside) dynamic interface
object network obj_any3
 nat (inside_3,outside) dynamic interface
object network obj_any4
 nat (inside_4,outside) dynamic interface
object network obj_any5
 nat (inside_5,outside) dynamic interface
object network obj_any6
 nat (inside_6,outside) dynamic interface
object network obj_any7
 nat (inside_7,outside) dynamic interface
object network smartrobotsip
 nat (any,inside_1) static interface service udp 5068 5068 
object network test
 nat (any,outside) static interface service tcp 5068 5068 
object network dns
 nat (any,outside) static interface service tcp domain domain 
object network PBX_insides
 nat (outside,inside_1) static interface service tcp 9966 9966 
access-group outside_access_in in interface outside
access-group inside_1_access_in in interface inside_1
access-group inside_access_in_2 in interface inside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside_1
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.1.0 255.255.255.0 inside_6
http 192.168.1.0 255.255.255.0 inside_7
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
 certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a
    308204d3 308203bb a0030201 02021018 dad19e26 7de8bb4a 2158cdcc 6b3b4a30 
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d30 
    36313130 38303030 3030305a 170d3336 30373136 32333539 35395a30 81ca310b 
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65 
    74776f72 6b313a30 38060355 040b1331 28632920 32303036 20566572 69536967 
    6e2c2049 6e632e20 2d20466f 72206175 74686f72 697a6564 20757365 206f6e6c 
    79314530 43060355 0403133c 56657269 5369676e 20436c61 73732033 20507562 
    6c696320 5072696d 61727920 43657274 69666963 6174696f 6e204175 74686f72 
    69747920 2d204735 30820122 300d0609 2a864886 f70d0101 01050003 82010f00 
    3082010a 02820101 00af2408 08297a35 9e600caa e74b3b4e dc7cbc3c 451cbb2b 
    e0fe2902 f95708a3 64851527 f5f1adc8 31895d22 e82aaaa6 42b38ff8 b955b7b1 
    b74bb3fe 8f7e0757 ecef43db 66621561 cf600da4 d8def8e0 c362083d 5413eb49 
    ca595485 26e52b8f 1b9febf5 a191c233 49d84363 6a524bd2 8fe87051 4dd18969 
    7bc770f6 b3dc1274 db7b5d4b 56d396bf 1577a1b0 f4a225f2 af1c9267 18e5f406 
    04ef90b9 e400e4dd 3ab519ff 02baf43c eee08beb 378becf4 d7acf2f6 f03dafdd 
    75913319 1d1c40cb 74241921 93d914fe ac2a52c7 8fd50449 e48d6347 883c6983 
    cbfe47bd 2b7e4fc5 95ae0e9d d4d143c0 6773e314 087ee53f 9f73b833 0acf5d3f 
    3487968a ee53e825 15020301 0001a381 b23081af 300f0603 551d1301 01ff0405 
    30030101 ff300e06 03551d0f 0101ff04 04030201 06306d06 082b0601 05050701 
    0c046130 5fa15da0 5b305930 57305516 09696d61 67652f67 69663021 301f3007 
    06052b0e 03021a04 148fe5d3 1a86ac8d 8e6bc3cf 806ad448 182c7b19 2e302516 
    23687474 703a2f2f 6c6f676f 2e766572 69736967 6e2e636f 6d2f7673 6c6f676f 
    2e676966 301d0603 551d0e04 1604147f d365a7c2 ddecbbf0 3009f343 39fa02af 
    33313330 0d06092a 864886f7 0d010105 05000382 01010093 244a305f 62cfd81a 
    982f3dea dc992dbd 77f6a579 2238ecc4 a7a07812 ad620e45 7064c5e7 97662d98 
    097e5faf d6cc2865 f201aa08 1a47def9 f97c925a 0869200d d93e6d6e 3c0d6ed8 
    e6069140 18b9f8c1 eddfdb41 aae09620 c9cd6415 3881c994 eea28429 0b136f8e 
    db0cdd25 02dba48b 1944d241 7a05694a 584f60ca 7e826a0b 02aa2517 39b5db7f 
    e784652a 958abd86 de5e8116 832d10cc defda882 2a6d281f 0d0bc4e5 e71a2619 
    e1f4116f 10b595fc e7420532 dbce9d51 5e28b69e 85d35bef a57d4540 728eb70e 
    6b0e06fb 33354871 b89d278b c4655f0d 86769c44 7af6955c f65d3208 33a454b6 
    183f685c f2424a85 3854835f d1e82cf2 ac11d6a8 ed636a
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group A request dialout pppoe
vpdn group A localname autovacbot@timebb
vpdn group A ppp authentication pap
vpdn username autovacbot@timebb password ***** 

dhcp-client update dns server both
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd domain autovacbot.ddns.net
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.254 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
 class class-default
  user-statistics accounting
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
hpm topN enable

result of packet-tracer :

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network PBX_insides
 nat (inside_1,outside) static interface service tcp 9966 9966 
Additional Information:
NAT divert to egress interface inside_1
Untranslate 202.184.50.94/9966 to 192.168.1.168/9966

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit ip any any 
Additional Information:

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside_access_in in interface outside
access-list outside_access_in extended permit ip any any 
Additional Information:

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network PBX_insides
 nat (inside_1,outside) static interface service tcp 9966 9966 
Additional Information:

Phase: 10
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 14
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 15
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 16
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 17
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 134700927, packet dispatched to next module

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside_1
output-status: up
output-line-status: up
Action: allow

PBX ip setting PBX IPV4 Setting

access rule: access rule

pbx firewall: firewall pbx pbx

source : any:any des: any:9966

source: public:any des: any:9966

source: public:any des: any:any

sou : any:9966 des: any:9966

sou: any:any des : any:any

sou: any:9966 des: any:any

sou: any:any des: private:any

all the about combination cant

btw im totally new to this hahaha without knowing any professional terms lol. Please tell me what i need to do.

Improve this question
2
  • 4
    I would very strongly advise against making your PBX accessible to the open and hostile Internet unless you also apply a very strict access rule, e.g. by source IP address. You might want to consider using VPN.
    – Zac67 ♦
    Jun 5, 2022 at 6:58
  • Notice that in Phase: 3, you have a drop by Implicit Rule in the ACL. Remember that every ACL has an implicit drop all at the end, so if you do not have a rule that explicitly permits the traffic, you will implicitly drop the traffic.
    – Ron Maupin ♦
    Jun 14, 2022 at 1:28

1 Answer 1

Reset to default
3

Your source and destination interfaces are reversed on the Advanced NAT page. Your outside interface is the source if you’re trying to access the PBX from the internet.

Edit: The remaining issues are incorrect ACL entries and an asymmetrical route cause by the sub-interface you made. So, to correct the issue, and get rid of the sub-interface you've created on Gi1/1 (because it's not needed), along with cleaning up a couple of things to remove some of the confusion, you can use the following commands:

object network PBX_insides
 nat (inside_1,outside) static interface service tcp 9966 9966
!
no access-list inside_1_access_in extended permit tcp object obj_any1 interface outside_PBX eq 9966
no access-list outside_access_in extended permit tcp any interface inside_1 eq 9966
clear config access-list outside_PBX_access_in
!
no interface GigabitEthernet1/1.9966
!
access-list outside_access_in extended permit tcp any object PBX_insides eq 9966

As a note, I would strongly advise, like Zac mentioned in the comment above, that you restrict access to your PBX to either limit access to specific source(s) or remove public access altogether and access it via a more secure method such as VPN.

Improve this answer
32
  • 1
    updated, its show running-config right?
    – Alvin
    Jun 8, 2022 at 6:21
  • 1
    Thank xd. So what I need to do is separate the dhcp? and the sub interface you mean is the static outside interface i created right, so need to use the PPPoX outside interface. Is that make difference when configure the port forwarding?
    – Alvin
    Jun 9, 2022 at 2:27
  • 1
    The PBX is using the same internet provider with the LAN
    – Alvin
    Jun 9, 2022 at 2:27
  • 1
    @Alvin I edited my answer to show you what you can do to fix the remaining issues.
    – Jesse P.
    Jun 9, 2022 at 3:08
  • 1
    @Alvin Corrected. See the updated NAT above. Sorry about that. I forgot you can’t reference a BVI in a NAT statement like that.
    – Jesse P.
    Jun 9, 2022 at 4:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.