Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

OPen port on ASA 5510

Hi,

I want any IP on the LAN which is behind the firewall to access an IP 64.x.x.x outside the firewall (on the internet) example any ip 192.168.0.50 to access ip 61.x.x.x on port 6999.

How would I go about this.

Port 6999 does not need to be open inbound into my LAN only outbound (from my LAN out onto the internet).

Cheers,

SZ

10 REPLIES
Cisco Employee

Re: OPen port on ASA 5510

Here you go (I assume that you need access to port 6999 on TCP as the protocol, and assuming that the destination on the internet is 61.5.5.5:

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host 61.5.5.5 eq 6999

OR/ if you would like to access a subnet on 61.5.5.4/30, it would be as follows:

access-list inside_access_in extended permit tcp 192.168.0.0  255.255.255.0 61.5.5.4 255.255.255.252 eq 6999

Hope that helps.

New Member

Re: OPen port on ASA 5510

Hi,

Thanks for you help.

If I type this;

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host 61.5.5.5 eq 6999, where it has 192.168.0.0, does that give all my LAN subnet access or should I specify the IP address that I need to grant access to.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

Cisco Employee

Re: OPen port on ASA 5510

To be more restrictive, you can allow just the 1 ip address from your LAN as follows:

For example: If you need access from source 192.168.0.50 towards destination 61.5.5..5 on port 6999:

access-list inside_access_in extended permit tcp host 192.168.0.50 host 61.5.5.5 eq 6999

Hope that helps. Please kindly rate useful post as Cisco will match every rating to $1 for the Haiti Earthquake. Thanks.

New Member

Re: OPen port on ASA 5510

Hi,

Thanks for your help.

How would I let all LAN ip addresses to access the WAN IP on port 6999.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

Cisco Employee

Re: OPen port on ASA 5510

When you mention WAN IP, do you mean the router in front of the ASA? If that is the case, here is the config:

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host eq 6999

New Member

Re: OPen port on ASA 5510

Hi,

No this IP is for an application we use which connects to a server on the internet.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

Cisco Employee

Re: OPen port on ASA 5510

OK, so it would be:

access-list inside_access_in extended permit tcp 192.168.0.0  255.255.255.0 host eq 6999

New Member

Re: OPen port on ASA 5510

Thanks for your help.

I will try it and let you know.

Sam Zebib  | DBR IT PTY LTD

Senior Network Engineer

t: 02 9524 1200         f: 02 9524 1175

49 Captain Cook Drive,  Taren Point, NSW 2229

samz@dbrit.com.au   www.dbrit.com.au

 Consider the environment - do you really need to print this email?

New Member

Re: OPen port on ASA 5510

Hi,

Below you have command

access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 host eq 6999

Where it says server IP, what should go in there,

Sam

Cisco Employee

Re: OPen port on ASA 5510

From your previous post, you mentioned this: "No this IP is for an application we use which connects to a server on  the internet."

So the destination ip address would be that server ip address that is on the Internet.

672
Views
0
Helpful
10
Replies
CreatePlease to create content