Hot Downloads

Welcome, Guest
Username: Password: Remember me

TOPIC: ASA 5520 NAT & PORTFORWARDING Configration

ASA 5520 NAT & PORTFORWARDING Configration 1 year 4 months ago #38639

  • im_bajaj110
  • im_bajaj110's Avatar
  • Offline
  • New Member
  • Posts: 2
  • Thank you received: 1
  • Karma: 0
Dear All,
I want to configure a port forwarding for CCTV setup on my ASA firewall.
Following are the details of my setup:

ASA 5520 : software version 8.4(5) ,ASDM 7.1

LAN IPs of DVR : 192.168.100.246-192.168.100.253 [ Total 8 DVRs]

Real IP : 168.187.104.101

TCP port : 37777

UDP Port : 37778

HTTP: 80

Kindly provide me the exact configuration module for the above scenario.
The administrator has disabled public write access.

ASA 5520 NAT & PORTFORWARDING Configration 1 year 3 months ago #38648

  • kev972
  • kev972's Avatar
  • Offline
  • New Member
  • Posts: 3
  • Thank you received: 1
  • Karma: 2
If i understand, you want to open TCP port 37777, UDP 37778, TCP 80 on the outside interface of your firewall to give access to some internal services for external users.
So, first time i do that in that way. Took me some time to understand but i wanted to be clean.
It is on IOS 8.4(2).
Just replace 192.168.1.x by 192.168.100.x, i forgot the right subnet when i end-up in configuration.

For the nat statement, i dont know if your global address was just the outside interface or some additional global address.
If it is an additional address, just replace "interface" keyword by 168.187.104.101

So you have to specify an object network where you will put all of your servers for a specific port and perform static nat on them.

object network DVR-SERVERS-37778
range 192.168.1.246 192.168.1.253
nat (inside,outside) static interface service udp 37778 37778



object network DVR-SERVERS-37777
range 192.168.1.246 192.168.1.253
nat (inside,outside) static interface service tcp 37777 37777


object network DVR-SERVERS-80
range 192.168.1.246 192.168.1.253
nat (inside,outside) static interface service tcp www www



Here is an object group with all the servers to avoid waste of time in the ACL.

object-group network DVR-HOSTS
description DVR-HOSTS-ADDR
network-object host 192.168.1.246
network-object host 192.168.1.247
network-object host 192.168.1.248
network-object host 192.168.1.249
network-object host 192.168.1.250
network-object host 192.168.1.251
network-object host 192.168.1.252
network-object host 192.168.1.253


Now i create object-group service to avoid waste of time in the acl again

object-group service DVR-TCP
service-object tcp destination eq www
service-object tcp destination eq 37777

object-group service DVR-UDP
service-object udp destination eq 37778


Now your 24 lines ACL in two lines :)
access-list outside extended permit object-group DVR-TCP any object-group DVR-HOSTS
access-list outside extended permit object-group DVR-UDP any object-group DVR-HOSTS



Verifications

packet-tracer input outside tcp 1.1.1.2 1234 1.1.1.1 80

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network DVR-SERVERS-80
nat (inside,outside) static interface service tcp www www
Additional Information:
NAT divert to egress interface inside
Untranslate 1.1.1.1/80 to 192.168.1.246/80

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outside in interface outside
access-list outside extended permit object-group DVR-TCP any object-group DVR-HOSTS
object-group service DVR-TCP
service-object tcp destination eq www
service-object tcp destination eq 37777
object-group network DVR-HOSTS
description: DVR-HOSTS-ADDR
network-object host 192.168.1.246
network-object host 192.168.1.247
network-object host 192.168.1.248
network-object host 192.168.1.249
network-object host 192.168.1.250
network-object host 192.168.1.251
network-object host 192.168.1.252
network-object host 192.168.1.253
Additional Information:

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network DVR-SERVERS-80
nat (inside,outside) static interface service tcp www www
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 56, packet dispatched to next module

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

Good exercice B)
Last Edit: 1 year 3 months ago by kev972.
The administrator has disabled public write access.
The following user(s) said Thank You: im_bajaj110

ASA 5520 NAT & PORTFORWARDING Configration 1 year 3 months ago #38656

  • Chris
  • Chris's Avatar
  • Offline
  • Administrator
  • Posts: 1446
  • Thank you received: 13
  • Karma: 8
Good one Kev!

Thanks for your valuable input.

Chris.
Chris Partsenidis.
Founder & Editor-in-Chief
www.Firewall.cx
The administrator has disabled public write access.

ASA 5520 NAT & PORTFORWARDING Configration 1 year 3 months ago #38661

  • im_bajaj110
  • im_bajaj110's Avatar
  • Offline
  • New Member
  • Posts: 2
  • Thank you received: 1
  • Karma: 0
Thank you so much for kind of help......its working now
The administrator has disabled public write access.
The following user(s) said Thank You: kev972

ASA 5520 NAT & PORTFORWARDING Configration 1 year 3 months ago #38662

  • Chris
  • Chris's Avatar
  • Offline
  • Administrator
  • Posts: 1446
  • Thank you received: 13
  • Karma: 8
Thumbs Up to kev972!

Cheers,
Chris Partsenidis.
Founder & Editor-in-Chief
www.Firewall.cx
The administrator has disabled public write access.
The following user(s) said Thank You: kev972
Time to create page: 0.091 seconds

CCENT/CCNA

Cisco Routers

  • SSL WebVPN
  • Securing Routers
  • Policy Based Routing
  • Router on-a-Stick

VPN Security

  • Understand DMVPN
  • GRE/IPSec Configuration
  • Site-to-Site IPSec VPN
  • IPSec Modes

Cisco Help

  • VPN Client Windows 8
  • VPN Client Windows 7
  • CCP Display Problem
  • Cisco Support App.

Windows 2012

  • New Features
  • Licensing
  • Hyper-V / VDI
  • Install Hyper-V

Linux

  • File Permissions
  • Webmin
  • Groups - Users
  • Samba Setup