Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Setting up port forwarding ASA 5505

Hello,

     We are trying to setup our ASA 5505 to do port forwarding to multiple internal servers and have run into some issues. A little background on what we are trying to do.

     We have 1 static external IP. Internally we have one exsisting server (10.1.1.184) that has port 80 forwarded to it and another exsisting server (10.1.1.185) that has port 443 forwarded to it. Both of these servers are serving seperate web apps to our employees who of course use them offsite. We have now added an additional server (10.1.1.186) that needs to use both ports 80 and 443. Is there any way to set it up so that these ports can be forwarded to all the servers that need them? Also, how would this work as far knowing what traffic will need to go to which server even though it is using the same port?

     The equipment is:

  • ASA 5505
  • ASA Version 7.2(4)
  • ASDM Version 5.2(4)

     I appologize in advance if what I'm trying to do is difficult/impossible. I inherted the ASA 5505 at this location and I was not here when it was initially installed. In fact no one on staff was here when it was initially installed. I did manage to find the passwords to it though. I'm not at all familiar with the ASA 5505 or Cisco secuirty appliances in general. Thank you in advance for the replies.

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Re: Setting up port forwarding ASA 5505

Joel,

That's correct - a static NAT plus the access-list entry allowing the traffic from outside to inside on the IP address plus tcp ports your server requires. No subinterface or second interface is required (assuming your additional IP is in the same network as the original one or that your ISP is routing it as in the example cited in the link you found). When you add the static NAT it will allow the ASA to respond to arps received on the outside interface, populate the xlate table and respond accord to the access-list and nat rules you have configured.

19 REPLIES
Hall of Fame Super Silver

Re: Setting up port forwarding ASA 5505

You can't do this exactly like you ask with only one public IP address. However, you can set up different public ports for you new server's private IP. Users would just specify the TCP port explicitly in the URL, overriding the default 80 or 443.

e.g., http://[ASA_outside_interface_IP]:8000

In ASDM, you would set this up under "Configuration, Firewall, NAT Rules". Create a rule for Interface "outside". Source is your outside interface address, destination the inside server's real IP address. Check the box to enable PAT. Choose a unique port number as the original port (like 8000 in the example URL above) and then 80 as translated port. Repeat by making a second NAT/PAT rule for the port 443 destination (using a different unique port number on the outside address). Then an an access-list rule to allow the new inbound connections. Apply and save.

New Member

Setting up port forwarding ASA 5505

Marvin,

     I had thought about that and the web searches I have done reffered to doing that as well. The issue I could see us running into would be that the software for the new server which the customer is running is coded to go directly to 80 and 443. We like the idea that no non standard ports would need to be opened on the customer's side to enable them to connect to our server. Would it be easier to request an additional external IP? Our ISP should be able to do that for us. If we do get an additional IP how would we set that up in the ASA 5505?

     Thank you for the quick response.

Hall of Fame Super Silver

Setting up port forwarding ASA 5505

Sure - if you have a second public IP, you simply set up a new NAT rule without the PAT bit. Just specify the new IP as the source and the real IP as the destination. You will still need to add an access list to allow outside to reach the server on ports 80 and 443.

New Member

Setting up port forwarding ASA 5505

Marvin,

     Talked to our ISP and it is no issue to have a second static IP. We are going to be placing the order in the next few minutes, should have it provisioned yet today. Should I mark this as answered and open an additional question if I have issues or wait untill we have it finished completely?

     I really appreciate your help with this.

Hall of Fame Super Silver

Setting up port forwarding ASA 5505

You're welcome. No hurry to mark it closed. Feel free to do so now or wait until after you've got it set up.

New Member

Setting up port forwarding ASA 5505

Probably easiest to get .186 remote users to add :8080 and :4443 to their http://wanipofyourrouter.

The idea being that the nat port translation will take care of proper routing.

Will need acl rules letting 8080 and 4443 through.

nat rules (config will depend on version - this is for 8.43 and adsm 6.4)

object network websecondserver

host 10.1.1.186

object network websecondserver

nat (inside, outside) static interface tcp 80 8080

object network remoteaccesssecondserver

host 10.1.1.186

object network remoteaccesssecondserver

nat (inside, outside) static interface tcp 443 4443

New Member

Setting up port forwarding ASA 5505

Alex,

     I appreciate the response. I believe we are going to be adding a second IP and setting it up as suggested by Marvin. This will allow us to continue using the standard ports for both groups of people.

New Member

Setting up port forwarding ASA 5505

Ensure you have more than the basic license for the ASA 5505, Im not sure if you can have two outside interfaces unless you have I think the plus or greater license........

Hall of Fame Super Silver

Setting up port forwarding ASA 5505

It won't be a second interface that he sets up - just a second IP on the existing outside interface to be used by the NAT rule only.

New Member

Setting up port forwarding ASA 5505

Ooops silly me.   Thanks for the correction.

New Member

Setting up port forwarding ASA 5505

Marvin,

     Just wanted to update you, we have our new external IP. We will be setting up the new information shortly. If I have any questions I'll be posting them here. Thanks again.

New Member

Setting up port forwarding ASA 5505

Marvin,

     We have the second IP and have it working per the ISP. However I was looking at the Configuration>Interfaces for Outside. When I do edit it doesn't seem to allow me to add a second IP or (more  likely) I have no idea what I'm doing. I'm using the ASDM 5.2 interface. Any help would be appreciated.

Joel

New Member

Setting up port forwarding ASA 5505

This is the only reference I found. Hope it has some kernel of usefulness.

http://www.networkstraining.com/how-to-configure-vlan-subinterfaces-cisco-asa-5500-firewall/

New Member

Re: Setting up port forwarding ASA 5505

Alex,

Thank you for the response. My confusion is that after re-reading Marvin's post it seems that I can do what I need with a static NAT. Any idea on that at all? Or am I just reading it wrong?

Sent from Cisco Technical Support iPad App

New Member

Re: Setting up port forwarding ASA 5505

Alex,

I did find this listed under another topic:

static (inside,outside)

https://supportforums.cisco.com/thread/2110044

That is the thread I pulled it from. Could really work like that?

Sent from Cisco Technical Support iPad App

Hall of Fame Super Silver

Re: Setting up port forwarding ASA 5505

Joel,

That's correct - a static NAT plus the access-list entry allowing the traffic from outside to inside on the IP address plus tcp ports your server requires. No subinterface or second interface is required (assuming your additional IP is in the same network as the original one or that your ISP is routing it as in the example cited in the link you found). When you add the static NAT it will allow the ASA to respond to arps received on the outside interface, populate the xlate table and respond accord to the access-list and nat rules you have configured.

New Member

Re: Setting up port forwarding ASA 5505

Marvin,

Thanks. I'll be trying this tomorrow. All the help is really appreciated.

Sent from Cisco Technical Support iPad App

New Member

Re: Setting up port forwarding ASA 5505

Marvin,

This got us up and running. Thank you so much for your help.

Sent from Cisco Technical Support iPad App

Hall of Fame Super Silver

Re: Setting up port forwarding ASA 5505

Great - you're welcome. Thanks for confirming the solution and letting us know.

5907
Views
0
Helpful
19
Replies
CreatePlease login to create content