Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Mobile devices accessing a single URL from internal office

I am working with a client who has two Windows servers:

  1. Server 1 is a SBS 2011 standard server (192.168.1.5)
  2. Server 2 is a Windows 2008 R2 server (192.168.1.9)

Naturally both servers have a fixed IP address.  Additionally the internet provider they use assigned a fixed IP address (I'm using 99.199.99.199 in this post instead of the real internet IP).  The ASA 5505 IP address is 192.168.1.15.

I am setting up a ASA 5505 with Security Plus license with unlimited users.  I have all of the SBS functionality working (i.e. internal / external email, wireless device support, Remote Access, etc.)

They are currently using two Netgear (home) routers for their internal and external wireless access.  I want to replace both Netgear routers with the ASA 5505 (in router mode) due to the fact that the ASA 5505 will isolate and insulate their business much more than any home wireless router.  Again, I have all the SBS 2011 features working as well as the wireless APs.

The client is a law firm and they use a software package called Winscribe that allows them to use their iPhones as dictation devices, both in the office and out of the office.  And this is where I'm running into problems.  Because the Winscribe software can be used externally and internally, the software "points" to a specific port on the domain URL of the law firm.  And to further complicate matters, the external port is redirected to the default port 80 on Server 2 (see attached file).  As you can see from the image, in Netgear terms the external port 8081 on the outside interface is redirected to port 80 on server 2.  I setup (what I thought would work) but I'm having several issues:

For whatever reason, the software (see Winscribe_screen_on_server.docx) is accessible (on server 1) only but if I click any of the options on the screen IE returns a "Page not available" message.  Even more strange is the fact that I go to a workstation and type in the http://99.199.99.199/winscribe/setup" path IE also displays a "Page not available" message.

So hopefully some folks out there in the community have had a similar experience and can help me get this resolved.

Here's what I think are the relevant parts of my ASA 5505 configuration:

!
ASA Version 9.2(1)
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
 switchport trunk allowed vlan 1,10
 switchport trunk native vlan 1
 switchport mode trunk
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 description LAN Interface
 nameif inside
 security-level 100
 ip address 192.168.1.15 255.255.255.0
!
interface Vlan2
 description WAN Interface
 nameif outside
 security-level 0
 ip address 99.199.99.199 255.255.255.252
!
interface Vlan10
 description Wireless APs
 nameif wireless
 security-level 50
 ip address 192.168.10.1 255.255.255.0
!
dns domain-lookup inside
dns domain-lookup wireless
dns server-group DefaultDNS
 name-server 192.168.1.5
 name-server 192.168.1.9
 domain-name harper.local
object network OBJ_INSIDE
 subnet 192.168.1.0 255.255.255.0
object network OBJ-192.168.1.5-SMTP
 host 192.168.1.5
object network OBJ-192.168.1.5-WWW
 host 192.168.1.5
object network OBJ-192.168.1.5-RDP
 host 192.168.1.5
object network OBJ-192.168.1.5-HTTPSSP
 host 192.168.1.5
object network OBJ_HLBSVR1
 host 192.168.1.5
object network OBJ-192.168.1.9-WINSCRIBE
 host 192.168.1.9
object network OBJ-192.168.1.5-HTTPS
 host 192.168.1.5
object network OBJ-WIRELESS
 subnet 192.168.10.0 255.255.255.0
object-group service INBOUND
 service-object tcp destination eq smtp
 service-object tcp destination eq www
 service-object tcp destination eq 3389
 service-object tcp destination eq 987
 service-object tcp destination eq https
object-group network SYSLOG_SERVERS
 network-object host 192.168.1.9
object-group service SYSLOG_SERVICES udp
 port-object eq 4010
object-group network RADIUS_SERVERS
 network-object host 192.168.1.5
object-group service RADIUS_SERVICES udp
 port-object eq radius
 port-object eq radius-acct
access-list SYSLOG extended permit udp any object-group SYSLOG_SERVERS object-group SYSLOG_SERVICES
access-list RADIUS extended permit udp any object-group RADIUS_SERVERS object-group RADIUS_SERVICES
access-list OUTSIDE_ACCESS_IN extended permit object-group INBOUND any object OBJ_HLBSVR1
access-list OUTSIDE_ACCESS_IN permit tcp any host 192.168.1.9 eq www
access-list OUTSIDE_ACCESS_IN extended deny ip any any log
!
object network OBJ_INSIDE
 nat (inside,outside) dynamic interface
object network OBJ-192.168.1.5-SMTP
 nat (inside,outside) static interface service tcp smtp smtp
object network OBJ-192.168.1.5-WWW
 nat (inside,outside) static interface service tcp www www
object network OBJ-192.168.1.5-RDP
 nat (inside,outside) static interface service tcp 3389 3389
object network OBJ-192.168.1.5-HTTPSSP
 nat (inside,outside) static interface service tcp 987 987
object network OBJ-192.168.1.5-HTTPS
 nat (inside,outside) static interface service tcp https https
object network OBJ-192.168.1.9-WINSCRIBE
 nat (inside,outside) static interface service tcp www 8081
object network OBJ-WIRELESS
 nat (wireless,outside) dynamic interface
access-group OUTSIDE_ACCESS_IN in interface outside
route outside 0.0.0.0 0.0.0.0 99.188.99.200 1
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside

dhcpd dns 8.8.8.8 8.8.8.4
dhcpd auto_config outside
!
dhcpd dns 192.168.1.5 8.8.8.8 interface inside
dhcpd domain harper.local interface inside
!
dhcpd address 192.168.10.2-192.168.10.100 wireless
dhcpd enable wireless
!
ntp authenticate
ntp server 192.168.1.5 source inside prefer

2 REPLIES

Hello, The setup is kind of

Hello,

 

The setup is kind of hard to understand.

 

The NAT rule in the NetGear box says that Port 8081 on the outside IP gets redirected to server 2 on port 80.

 

When the mobile clients are on the office do they connect to the private IP (.9) of Server 2 on port 80 directly?

 

 

From outside mobile clients should be really easy but just want to make sure what is actually down right now.

 

Regards,

 

Jcarvaja

Senior Network Security and Core Specialist
CCIE #42930, 2-CCNP, JNCIS-SEC

For inmediate assistance hire us at http://inetworks.cr/our-rates/

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
New Member

The internal subnet is 192

The internal subnet is 192.168.1.x.

Server 1 (SBS 2011 Std) IP address is 192.168.1.5

Server 2 (Windows 2008 R2 Std) IP address is 192.168.1.9

Router (ASA 5505) IP address is 192.168.1.15

Outside IP I'm using for this post (no actual outside IP) is 99.199.99.199

You are correct in that the outside IP (port 8081) is redirected to port 80 of the 1.9 server (2008 R2).

Also, note that port 80 on the outside IP is redirected to the 1.5 SBS 2011 server.

So the issue is that all the iPhones/iPads that have the Winscribe software setup are referencing the external IP with port 8081 as follows (not actual outside IP):

http:://99.199.99.199:8081/winscribe/setup

The existing Netgear router redirects port 8081 from the outside IP to port 80 on the 1.9 server.  The rules I setup to duplicate this behavior are as follows:

object network OBJ-192.168.1.9-WINSCRIBE
 host 192.168.1.9
 nat (inside,outside) static interface service tcp www 8081 

object-group service INBOUND
 service-object tcp destination eq smtp 
 service-object tcp destination eq www 
 service-object tcp destination eq 3389 
 service-object tcp destination eq 987 
 service-object tcp destination eq https 
access-list OUTSIDE_ACCESS_IN extended permit object-group INBOUND any object OBJ_HLBSVR1 
access-list OUTSIDE_ACCESS_IN permit tcp any host 192.168.1.9 eq www
access-list OUTSIDE_ACCESS_IN extended deny ip any any log 
access-group OUTSIDE_ACCESS_IN in interface outside

 

 

When I did this and type in the http:://99.199.99.199:8081/winscribe/setup address in IE (on server 192.168.1.5), I did get the Winscribe page attached to my earlier entry.  However, if I go to a workstation and type http:://99.199.99.199:8081/winscribe/setup in IE, I get the "Page not available" message.

So I guess my confusion could probably be summarized as follows:

  1. why I could only get to that page when I was on the 1.5 server and not the workstations
  2. what needs to happen to allow that 99.199.99.199 outside IP to be allowed to internal clients.  I'm thinking the Netgear router was letting all the 99.199.99.199 traffic whereas the ASA 5505 isn't.  It's an odd setup (in my opinion) to have your mobile devices always use the outside IP within the building.  My understanding is that it was setup that way so the iPhones/iPads would work outside of the office.  So in essence, they're basically using the away-from-office setup for both internal and external software functionality.

Thanks!

 

 

1086
Views
0
Helpful
2
Replies