Remote Desktop to server via ASA 5505

Unanswered Question
Sep 17th, 2007
User Badges:

Need to configure ASA 5505 to allow remote desktop session from Internet (outside) to server on inside interface.

DSL modem is in bridge mode. I have a single live IP configured on outside interface (it's the only live IP I have for that site...leased from Embarq). I've enabled static translation from outside ip to inside ip on server ( Do not have router on inside interface...all hosts within LAN have default gw set to inside int on 5505 ( Config is below:

interface Vlan1

nameif inside

security-level 100

ip address

interface Vlan2

nameif outside

security-level 0

ip address 65.x.x.26

interface Ethernet0/0

switchport access vlan 2

access-list outside_int extended permit ip 165.x.x.0 host 65.x.x.26

global (outside) 1 interface

nat (inside) 1

static (inside,outside) 65.x.x.26 netmask

access-group outside_int in interface outside

route outside 0.0.0.x.x.162.1 1

telnet inside

telnet 165.x.x.0 outside

I've tried so many variations on above config based on example documentation found online and nothing has worked. Any ideas what might be wrong?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
JORGE RODRIGUEZ Mon, 09/17/2007 - 10:32
User Badges:
  • Green, 3000 points or more

have you try static PAT specifying the RDP tcp port.


static (inside,outside) tcp 3389 3389 netmask

and create access-list allowin TCP 3389 any from outside to inside host

see if that works.


tyson.mock Wed, 09/19/2007 - 15:11
User Badges:

Unfortunately, your suggestions did not allow access to the internal server.

I'm curious if anyone can confirm that since we only have a single live IP (that is assigned to the outside interface on the 5505), is it possible to use that same live ip to attempt communication to an internal server using tcp port 3389? Or, would that require an additional IP address?

Thank you for your suggestions.

whisperwind Thu, 09/20/2007 - 12:12
User Badges:

Yes it is possible I have a pix on my dsl connection and have setup a webserver and when you hit my external public IP my config redirects an port 80 traffic to my internal web server.

This is done just like Jorge described, if it is not working either post the config following his template here for review and/or look a bit deeper to make sure all the other pieces are correct like the server.

tyson.mock Fri, 09/21/2007 - 08:33
User Badges:

That worked! I have no idea why but I'm not going to complain. I'm just happy to finally see some success.

Using "interface" instead of the external ip address in the static translation statement solved the problem. I'm now able to remotely manage this server. Thanks for the advice!

srue Fri, 09/21/2007 - 11:10
User Badges:
  • Blue, 1500 points or more

to be consistent you should also change your acl entry to:

access-list outside_int extended permit ip 165.x.x.0 interface outside

JORGE RODRIGUEZ Fri, 09/21/2007 - 16:35
User Badges:
  • Green, 3000 points or more

Something I have learned today in this particular case !


This Discussion