06-03-2014 11:35 AM - edited 03-11-2019 09:16 PM
Hi I need to add multiple entries of the following on a 5510 running asa903-k8.bin and ASDM-716.bin file.:
object network Mitel5000-01
host 10.2.254.111
object network Mitel5000-02
host 10.2.254.111
object network Mitel5000-03
host 10.2.254.111
object network Mitel5000-04
host 10.2.254.111
object network Mitel5000-05
host 10.2.254.111
nat (Inside,Outside) static interface service udp 6031 6031
object network Mitel5000-01
nat (Inside,Outside) static interface service udp 6032 6032
object network Mitel5000-02
nat (Inside,Outside) static interface service udp 6033 6033
object network Mitel5000-03
nat (Inside,Outside) static interface service udp 6034 6034
object network Mitel5000-04
nat (Inside,Outside) static interface service udp 6035 6035
object network Mitel5000-05
nat (Inside,Outside) static interface service udp 6036 6036
object network Mitel5000-06
nat (Inside,Outside) static interface service udp 6037 6037
access-list inbound extended permit udp any4 object Mitel5000 eq 5004
access-list inbound extended permit udp any4 object Mitel5000 eq 5005
access-list inbound extended permit udp any4 object Mitel5000 eq 5006
access-list inbound extended permit udp any4 object Mitel5000 eq 5007
access-list inbound extended permit udp any4 object Mitel5000 eq 50098
Is there a way were I could just put a range in for all three of the configs? I am completely new and would love some help.
Thanks.
Solved! Go to Solution.
06-06-2014 04:06 AM
What do I need to put to get the range of ports?
I am not 100% sure I understand what you mean by range of ports. But, if I understand correctly, you could create a service object that defines the range of ports and then call that object group in the NAT statement...for example
object service PORT-RANGE
service tcp destination range 1024 4000
object network Mitel5000-HOST
host 10.2.254.111
nat (Inside,Outside) source static Mitel5000-HOST interface service PORT-RANGE PORT-RANGE
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 04:47 AM
basically if you applied that ACL to the Inside interface you would only be permiting gre and PPTP traffic, all other traffic will be dropped that is generated from the Inside network and entering the ASA.
Unless you have a requirement to deny the Inside users access to certain servers, PCs, etc., then I would leave the configuration as is. your current configuration will allow all traffic from a higher security level to an equal or lower security. So your inside users will not be restricted as things stand now.
--
Please remember to select a correct answer and rate helpful posts
06-04-2014 03:51 AM
It is possible to group the NAT statements into two statement.
access-list inbound extended permit udp any4 object Mitel5000 range 5004 5007
access-list inbound extended permit udp any4 object Mitel5000 eq 50098
object network Mitel5000-HOST
host 10.2.254.111
object service Mitel-Ports1
service udp destination range 5004 5007
object service Mitel-Ports2
service udp destination eq 50098
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports2 Mitel-Ports2
--
Please remember to select a correct answer and rate helpful posts
06-05-2014 11:56 AM
Hi thanks for your help. Can I ask does this look right?
object network Mitel5000-HOST
host 10.2.254.111
object service Mitel-Ports1
service udp destination range 5004 5007
object service Mitel-Ports2
service udp destination range 6004 6261
object service Mitel-Ports3
service udp destination range 6604 7039
object service Mitel-Ports4
service udp destination range 50098 50508
access-list inbound extended permit udp any4 object Mitel5000 range 5004 5007
access-list inbound extended permit udp any4 object Mitel5000 range 6004 6261
access-list inbound extended permit udp any4 object Mitel5000 range 6604 7039
access-list inbound extended permit udp any4 object Mitel5000 range 50098 50508
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports4 Mitel-Ports4
And can this be shortened?
access-list inbound extended permit tcp any interface Outside eq 6800
access-list inbound extended permit tcp any interface Outside eq 6801
access-list inbound extended permit tcp any interface Outside eq 6802
access-list inbound extended permit tcp any interface Outside eq 3998
access-list inbound extended permit tcp any interface Outside eq 3999
To this?
access-list inbound extended permit tcp any interface Outside range 6800 6801
access-list inbound extended permit tcp any interface Outside range 3998 3999
object service Mitel-Ports5
service udp destination range 6800 6801
object service Mitel-Ports6
service udp destination range 3998 3999
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports6 Mitel-Ports6
Thank you SOOOO very much for your help so far. I think I got it but would love your further input.
06-05-2014 12:11 PM
This is my final config, would you please tell me if I have it right:
enable password XXXXXX
password XXXXXX
User Enable password XXXXXX
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
name 10.2.254.11 ECHS-PDC
name 10.2.254.12 ECHS-XCH
name 10.2.254.111 Mitel5000
int e0/0
nameif Outside
security-level 0
ip address X.X.X.X 255.255.255.240
no shutdown
description WAN Interface
exit
int e0/1
nameif Inside
security-level 100
ip address 10.2.254.9 255.255.255.0
no shutdown
description LAN Interface
exit
int e0/2
nameif VoIP-Link
security-level 100
ip address 10.2.111.1 255.255.255.0
no shutdown
description VOIP Interface
exit
int e0/3
no shutdown
exit
int Management0/0
nameif Management
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
telnet 10.2.254.0 255.255.255.0 Inside
telnet 10.0.0.0 255.0.0.0 Inside
telnet timeout 5
http server enable
http 10.2.254.0 255.255.255.0 Inside
http 10.0.0.0 255.0.0.0 Inside
http 192.168.1.0 255.255.255.0 Management
dhcpd address 192.168.1.2-192.168.1.5 Management
dhcpd enable Management
ssh 10.2.254.0 255.255.255.0 Inside
ssh 192.168.1.0 255.255.255.0 Management
ssh timeout 30
console timeout 0
aaa authentication ssh console LOCAL
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network ECHS-XCH
host 10.2.254.12
object network ECHS-XCH-01
host 10.2.254.12
object network ECHS-PDC
host 10.2.254.11
object network Mitel5000-HOST
host 10.2.254.111
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list outbound extended permit gre any4 any4
access-list outbound extended permit tcp any4 any4 eq pptp
access-list inbound extended permit tcp any4 object ECHS-XCH eq www
access-list inbound extended permit tcp any4 object ECHS-XCH eq https
access-list inbound extended permit tcp any4 object ECHS-PDC eq pptp
access-list inbound extended permit udp any4 object Mitel5000 range 5004 5007
access-list inbound extended permit udp any4 object Mitel5000 range 6004 6261
access-list inbound extended permit udp any4 object Mitel5000 range 6604 7039
access-list inbound extended permit udp any4 object Mitel5000 range 50098 50508
access-list inbound extended permit tcp any interface Outside range 6800 6801
access-list inbound extended permit tcp any interface Outside range 3998 3999
object network ECHS-XCH
nat (Inside,Outside) static interface service tcp https https
object network ECHS-XCH-01
nat (Inside,Outside) static interface service tcp www www
object network ECHS-PDC
nat (Inside,Outside) static interface service tcp pptp pptp
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports4 Mitel-Ports4
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports6 Mitel-Ports6
object service Mitel-Ports1
service udp destination range 5004 5007
object service Mitel-Ports2
service udp destination range 6004 6261
object service Mitel-Ports3
service udp destination range 6604 7039
object service Mitel-Ports4
service udp destination range 50098 50508
object service Mitel-Ports5
service udp destination range 6800 6801
object service Mitel-Ports6
service udp destination range 3998 3999
object network obj_any
nat (Inside,Outside) dynamic interface
access-group inbound in interface Outside
route Outside 0.0.0.0 0.0.0.0 X.X.X..49 1
route Inside 10.2.246.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.247.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.248.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.249.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.250.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.251.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.252.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.253.0 255.255.255.0 10.2.254.19 1
logging asdm 6
domain-name XXXXXXXXXXXXXXXXXXX
crypto key generate rsa
06-06-2014 12:27 AM
Yes both those examples you posted there look good but remember to reference the Mitel5000-HOST object group in the NAT statements.
As for your configuration, you are using an IP to name map that is referenced in the NAT statements. You must reference an object group in the NAT statements so change Mitel5000 to Mitel5000-HOST.
Also, you do not have a dynamic PAT to allow internet access...even though you have an object group matching all traffic. I suggest adding a NAT statement for this object group if the users require access to the internet.
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
Other than that it looks good.
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 01:56 AM
Hi Thanks for the replie. I really apperciate your help. A couple a quick questions. I am not sure what you mean by "reference the Mitel5000-HOST object group in the NAT statements."
Am I correct in saying I need to change this bit:
name 10.2.254.11 ECHS-PDC
name 10.2.254.12 ECHS-XCH
name 10.2.254.111 Mitel5000
to this:
name 10.2.254.11 ECHS-PDC
name 10.2.254.12 ECHS-XCH
name 10.2.254.111 Mitel5000-HOST
Also users need internet access and I thought I had done by this statement:
object network obj_any
nat (Inside,Outside) dynamic interface
(Its just before the routing tables in the above example). Do I need to enter it has
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (Inside,Outside) dynamic interface
Or do I need to enter it has:
object network obj_any
nat (Inside,Outside) dynamic interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
Sorry for being a pain and asking tom many questions. You have been a great support. I realy want to put this issue to bed and value your input.
06-06-2014 02:00 AM
Hi
When you say "reference the Mitel5000-HOST object group in the NAT statements."
Do you mean I need to change this:
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports4 Mitel-Ports4
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports6 Mitel-Ports6
To this:
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports4 Mitel-Ports4
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports6 Mitel-Ports6
06-06-2014 02:04 AM
Is this ok now?
enable password xxxx
password xxxx
User Enable password xxxx
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
name 10.2.254.11 ECHS-PDC
name 10.2.254.12 ECHS-XCH
name 10.2.254.111 Mitel5000-HOST
int e0/0
nameif Outside
security-level 0
ip address x.x.x.53 255.255.255.240
no shutdown
description WAN Interface
exit
int e0/1
nameif Inside
security-level 100
ip address 10.2.254.9 255.255.255.0
no shutdown
description LAN Interface
exit
int e0/2
nameif VoIP-Link
security-level 100
ip address 10.2.111.1 255.255.255.0
no shutdown
description VOIP Interface
exit
int e0/3
no shutdown
exit
int Management0/0
nameif Management
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
telnet 10.2.254.0 255.255.255.0 Inside
telnet 10.0.0.0 255.0.0.0 Inside
telnet timeout 5
http server enable
http 10.2.254.0 255.255.255.0 Inside
http 10.0.0.0 255.0.0.0 Inside
http 192.168.1.0 255.255.255.0 Management
dhcpd address 192.168.1.2-192.168.1.5 Management
dhcpd enable Management
ssh 10.2.254.0 255.255.255.0 Inside
ssh 192.168.1.0 255.255.255.0 Management
ssh timeout 30
console timeout 0
aaa authentication ssh console LOCAL
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network ECHS-XCH
host 10.2.254.12
object network ECHS-XCH-01
host 10.2.254.12
object network ECHS-PDC
host 10.2.254.11
object network Mitel5000-HOST
host 10.2.254.111
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list outbound extended permit gre any4 any4
access-list outbound extended permit tcp any4 any4 eq pptp
access-list inbound extended permit tcp any4 object ECHS-XCH eq www
access-list inbound extended permit tcp any4 object ECHS-XCH eq https
access-list inbound extended permit tcp any4 object ECHS-PDC eq pptp
access-list inbound extended permit udp any4 object Mitel5000-HOST range 5004 5007
access-list inbound extended permit udp any4 object Mitel5000-HOST range 6004 6261
access-list inbound extended permit udp any4 object Mitel5000-HOST range 6604 7039
access-list inbound extended permit udp any4 object Mitel5000-HOST range 50098 50508
access-list inbound extended permit tcp any interface Outside range 6800 6801
access-list inbound extended permit tcp any interface Outside range 3998 3999
object network ECHS-XCH
nat (Inside,Outside) static interface service tcp https https
object network ECHS-XCH-01
nat (Inside,Outside) static interface service tcp www www
object network ECHS-PDC
nat (Inside,Outside) static interface service tcp pptp pptp
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports4 Mitel-Ports4
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports6 Mitel-Ports6
object service Mitel-Ports1
service udp destination range 5004 5007
object service Mitel-Ports2
service udp destination range 6004 6261
object service Mitel-Ports3
service udp destination range 6604 7039
object service Mitel-Ports4
service udp destination range 50098 50508
object service Mitel-Ports5
service udp destination range 6800 6801
object service Mitel-Ports6
service udp destination range 3998 3999
object network obj_any
nat (Inside,Outside) dynamic interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
access-group inbound in interface Outside
route Outside 0.0.0.0 0.0.0.0 x.x.x.49 1
route Inside 10.2.246.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.247.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.248.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.249.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.250.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.251.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.252.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.253.0 255.255.255.0 10.2.254.19 1
logging asdm 6
domain-name x-x-x
crypto key generate rsa
06-06-2014 02:08 AM
Yes, looks good now.
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 02:04 AM
Sorry I had overlooked the obj_any NAT statement.
name 10.2.254.111 Mitel5000-HOST
The above is not a network object, this is an alias (a mapping of IP to a name)
object network Mitel5000-HOST
host 10.2.254.111
The above is a network object
You are referencing the alias in your NAT statements and not the object group
nat (inside,outside) source static Mitel5000 interface service Mitel-Ports1 Mitel-Ports1
This will not work since Mitel5000 is not a network object...you will get an error when entering this... or at least I got an error last time I tried to do this.
Sorry for being a pain and asking tom many questions.
No worries
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 02:59 AM
Hi - Many thanks again. I get errors on the following commands:
nat (Inside,Outside) static interface service tcp pptp pptp
Being:
ciscoasa(config)# nat (Inside,Outside) static interface service tcp pptp pptp
^
ERROR: % Invalid input detected at '^' marker.
ciscoasa(config)#
Any ideas?
06-06-2014 03:03 AM
Have you defined the Inside interface already?
It seems to indicate that the interface name does not exist.
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 03:06 AM
By the way my fonal config, which I tested in the lab and get no errors, look like this...
enable password XXXX
password XXXX
User Enable password XXXX
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
name 10.2.254.11 ECHS-PDC
name 10.2.254.12 ECHS-XCH
object network Mitel5000-HOST
host 10.2.254.111
int e0/0
nameif Outside
security-level 0
ip address X.X.X.53 255.255.255.240
no shutdown
description WAN Interface
exit
int e0/1
nameif Inside
security-level 100
ip address 10.2.254.9 255.255.255.0
no shutdown
description LAN Interface
exit
int e0/2
nameif VoIP-Link
security-level 100
ip address 10.2.111.1 255.255.255.0
no shutdown
description VOIP Interface
exit
int e0/3
no shutdown
exit
int Management0/0
nameif Management
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
telnet 10.2.254.0 255.255.255.0 Inside
telnet 10.0.0.0 255.0.0.0 Inside
telnet timeout 5
http server enable
http 10.2.254.0 255.255.255.0 Inside
http 10.0.0.0 255.0.0.0 Inside
http 192.168.1.0 255.255.255.0 Management
dhcpd address 192.168.1.2-192.168.1.5 Management
dhcpd enable Management
ssh 10.2.254.0 255.255.255.0 Inside
ssh 192.168.1.0 255.255.255.0 Management
ssh timeout 30
console timeout 0
aaa authentication ssh console LOCAL
object network ECHS-XCH
host 10.2.254.12
object network ECHS-XCH-01
host 10.2.254.12
object network ECHS-PDC
host 10.2.254.11
object network Mitel5000-HOST
host 10.2.254.111
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
object network ECHS-XCH
nat (Inside,Outside) static interface service tcp https https
object network ECHS-XCH-01
nat (Inside,Outside) static interface service tcp www www
object network ECHS-PDC
access-list outbound extended permit gre any4 any4
access-list outbound extended permit tcp any4 any4 eq pptp
access-list inbound extended permit udp any4 object Mitel5000-HOST range 5004 5007
access-list inbound extended permit udp any4 object Mitel5000-HOST range 6004 6261
access-list inbound extended permit udp any4 object Mitel5000-HOST range 6604 7039
access-list inbound extended permit udp any4 object Mitel5000-HOST range 50098 50508
access-list inbound extended permit tcp any interface Outside range 6800 6801
access-list inbound extended permit tcp any interface Outside range 3998 3999
access-list inbound extended permit tcp any4 object ECHS-PDC eq pptp
access-list inbound extended permit tcp any4 object ECHS-XCH eq www
access-list inbound extended permit tcp any4 object ECHS-XCH eq https
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object service Mitel-Ports1
service udp destination range 5004 5007
object service Mitel-Ports2
service udp destination range 6004 6261
object service Mitel-Ports3
service udp destination range 6604 7039
object service Mitel-Ports4
service udp destination range 50098 50508
object service Mitel-Ports5
service udp destination range 6800 6801
object service Mitel-Ports6
service udp destination range 3998 3999
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports1 Mitel-Ports1
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports2 Mitel-Ports2
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports3 Mitel-Ports3
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports4 Mitel-Ports4
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports5 Mitel-Ports5
nat (inside,outside) source static Mitel5000-HOST interface service Mitel-Ports6 Mitel-Ports6
access-group inbound in interface Outside
route Outside 0.0.0.0 0.0.0.0 X.X.X.49 1
route Inside 10.2.246.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.247.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.248.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.249.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.250.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.251.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.252.0 255.255.255.0 10.2.254.19 1
route Inside 10.2.253.0 255.255.255.0 10.2.254.19 1
logging asdm 6
domain-name X-X-X
crypto key generate rsa
The only command I am missing is...
nat (Inside,Outside) static interface service tcp pptp pptp
Not sure what this command is for but when I run it I get error message of:
ciscoasa(config)#
ciscoasa(config)# nat (Inside,Outside) static interface service tcp pptp pptp
^
ERROR: % Invalid input detected at '^' marker.
ciscoasa(config)#
Please could show us what I am doing wrong? Again many thanks for your help.
06-06-2014 03:15 AM
ah ok here is the problem:
ciscoasa(config)# nat (Inside,Outside) static interface service tcp pptp pptp
you need to add this type of command under a network object. for example
object network TEST
subnet 1.1.1.0 255.255.255.0
nat (Inside,Outside) static interface service tcp pptp pptp
--
Please remember to select a correct answer and rate helpful posts
06-06-2014 03:52 AM
Hi, thanks for that. Can I ask if I do the following:
object network Mitel5000-HOST
host 10.2.254.111
nat (Inside,Outside) static interface service udp X X
What do I need to put to get the range of ports? I am comparing with..
object network ECHS-PDC
host 10.2.254.11
object network ECHS-PDC
nat (Inside,Outside) static interface service tcp pptp pptp
Many thanks again for your continuous support. Your unreal!!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide