Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Setting up FTP server behind ASA 5505, need some sort of port forwarding

My company uses a Cisco ASA 5505 Adaptive Security Appliance, and I am trying to set up a SFTP server that can be accessed from the Internet.

Is there any way to simply set up port forwarding for my FTP port (4610) to the ip address with the server, as I would do on a simple Linksys router? Or do I need to set up some sort of DMZ?

Any help would be greatly appreciated.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

No you don't necessarily need a dmz, inside will work fine. I assume you will want to use the ip of the outside interface of the ASA for this? If so, it would looks something like this. Where x.x.x.x is the inside/private ip of the ftp server.

static (inside,outside) tcp interface 4610 x.x.x.x 4610 netmask 255.255.255.255

access-list outside_access_in extended permit tcp any interface outside eq 4610

access-group outside_access_in in interface outside

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Can you use the 192.168.1.106 ip address from inside?

If you definitely want to use the outside address from the inside you need something called hairpinning.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

same-security-traffic permit intra-interface

global (inside) 1 interface

nat (inside) 1 0 0

static (inside,inside) 192.168.1.106 netmask 255.255.255.255

18 REPLIES
Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

No you don't necessarily need a dmz, inside will work fine. I assume you will want to use the ip of the outside interface of the ASA for this? If so, it would looks something like this. Where x.x.x.x is the inside/private ip of the ftp server.

static (inside,outside) tcp interface 4610 x.x.x.x 4610 netmask 255.255.255.255

access-list outside_access_in extended permit tcp any interface outside eq 4610

access-group outside_access_in in interface outside

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Thanks a lot! So do I just type that in the command-line interface?

I'm using the ASDM GUI in Windows, and I know I can access the command line by going Tools->Command Line Interface.

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

The command line utility in the ASDM is not what I would recommend. If you wanted cli I would use telnet or ssh.

I tried to find you an example using the ASDM here....but couldn't find one.

http://cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

I'm a beginner with the 5505, so I'm just not sure how I'm supposed to enter that information. What's the easiest way? Can I do it using the GUI, by going to the configuration tab?

Thanks!

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Ok, I set up those rules, but it still doesn't work. The ASDM (after refreshing) shows a new security policy access rule and a new static NAT rule. Am I missing something?

And yes, what I want is for someone on the Internet to type in the cable modem's ip address (the outside address), and to have that sent through to the computer with the FTP server running.

It's frustrating, because doing this is so simple in a basic router, it's just a quick port forward. I have no experience in a device like the ASA 5505, so I'm learning as I go, but they don't make it easy. All of the documentation and examples seem to be made for people who already know what they're doing.

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Go to File -> Show running config in new window

Copy the config out and paste it here.

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Here it is:

: Saved

:

ASA Version 7.2(3)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password xx

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd xxx

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group service SFTP tcp

description our SFTP server

port-object range 4600 4620

access-list outside_access_in extended permit tcp any interface outside eq 4610

pager lines 24

logging enable

logging asdm-buffer-size 512

logging buffered warnings

logging asdm warnings

logging flash-maximum-allocation 100000

logging ftp-bufferwrap

logging ftp-server 192.168.1.106 / user ****

mtu inside 1500

mtu outside 1500

mtu dmz 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface 4610 192.168.1.106 4610 netmask 255.255.255.255

access-group outside_access_in in interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh 192.168.1.106 255.255.255.255 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.1.10-192.168.1.33 inside

dhcpd enable inside

!

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:xxx

: end

asdm image disk0:/asdm-523.bin

asdm history enable

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Config looks ok. Is the ftp server listening on 4610?

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Yeah. And when I try to connect by putting in the local ip address (192.168.etc), it connects fine. But when I put in the external ip address, it just times out.

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

When you say "But when I put in the external ip address, it just times out.", are you doing this from the inside, outside or both?

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Inside. Could that be causing the problem? Before I got the ASA 5505, I could do that no problem.

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Yes, unfortunately that is the problem. But there is a way to do it. Are you using an ip address, hostname, or both when you connect?

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

ip address.

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Can you use the 192.168.1.106 ip address from inside?

If you definitely want to use the outside address from the inside you need something called hairpinning.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

same-security-traffic permit intra-interface

global (inside) 1 interface

nat (inside) 1 0 0

static (inside,inside) 192.168.1.106 netmask 255.255.255.255

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Yes, from the inside I can use the 192.168.1.106 address and it works fine. I just want to test it to make sure it works from the outside. Would it be easier just to test it by connecting from my home pc?

Green

Re: Setting up FTP server behind ASA 5505, need some sort of por

Yes it would.

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

Cool, thanks. I'll try doing that.

Community Member

Re: Setting up FTP server behind ASA 5505, need some sort of por

I tried it out, and it works great.

Thanks for all the help.

5016
Views
0
Helpful
18
Replies
CreatePlease to create content