09-17-2007 06:32 AM - edited 03-11-2019 04:12 AM
Need to configure ASA 5505 to allow remote desktop session from Internet (outside) to server on inside interface.
DSL modem is in bridge mode. I have a single live IP configured on outside interface (it's the only live IP I have for that site...leased from Embarq). I've enabled static translation from outside ip to inside ip on server (10.7.0.1). Do not have router on inside interface...all hosts within LAN have default gw set to inside int on 5505 (10.7.254.1). Config is below:
interface Vlan1
nameif inside
security-level 100
ip address 10.7.254.1 255.255.0.0
interface Vlan2
nameif outside
security-level 0
ip address 65.x.x.26 255.255.255.128
interface Ethernet0/0
switchport access vlan 2
access-list outside_int extended permit ip 165.x.x.0 255.255.255.0 host 65.x.x.26
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 65.x.x.26 10.7.0.1 netmask 255.255.255.255
access-group outside_int in interface outside
route outside 0.0.0.0 0.0.0.x.x.162.1 1
telnet 10.0.0.0 255.0.0.0 inside
telnet 165.x.x.0 255.255.255.0 outside
I've tried so many variations on above config based on example documentation found online and nothing has worked. Any ideas what might be wrong?
09-17-2007 10:32 AM
have you try static PAT specifying the RDP tcp port.
e.g
static (inside,outside) tcp 65.174.162.26 3389 10.7.0.1 3389 netmask
255.255.255.255
and create access-list allowin TCP 3389 any from outside to inside host 10.7.0.1
see if that works.
Jorge
09-19-2007 03:11 PM
Unfortunately, your suggestions did not allow access to the internal server.
I'm curious if anyone can confirm that since we only have a single live IP (that is assigned to the outside interface on the 5505), is it possible to use that same live ip to attempt communication to an internal server using tcp port 3389? Or, would that require an additional IP address?
Thank you for your suggestions.
09-20-2007 12:12 PM
Yes it is possible I have a pix on my dsl connection and have setup a webserver and when you hit my external public IP my config redirects an port 80 traffic to my internal web server.
This is done just like Jorge described, if it is not working either post the config following his template here for review and/or look a bit deeper to make sure all the other pieces are correct like the server.
09-20-2007 08:29 PM
Change your static (inside,outside).... command to
static (inside,outside) tcp interface 3389 192.168.20.15 3389 netmask 255.255.255.255
Using the interface key word works where using the ip address of the same interface doesn't. I had the same problem.
09-21-2007 08:33 AM
That worked! I have no idea why but I'm not going to complain. I'm just happy to finally see some success.
Using "interface" instead of the external ip address in the static translation statement solved the problem. I'm now able to remotely manage this server. Thanks for the advice!
09-21-2007 11:10 AM
to be consistent you should also change your acl entry to:
access-list outside_int extended permit ip 165.x.x.0 255.255.255.0 interface outside
09-21-2007 04:35 PM
Something I have learned today in this particular case !
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide