Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is likely a common issue, but cannot find a solution.

Here's the problem: in web server environment there are a set of common ports that need to be open, to name a few: 21,25,53,80,110,143,3306, etc.

I know how to create an access-list to allow an external ip on a given port and a static rule to direct port traffic to target internal ip. However, man, that is a lot of drudgery doing single ip + single port rules when you have 15 public IPs all of which need the exact same 20-odd ports open.

Is there a way to per public ip specify an access-list of ports and a corresponding static rule?? Basically I'd like to pull this off in 30 lines ( 15 public ips X (1 access-list + 1 static) ) vs 600!

Ideas much appreciated (in this case, obviously) ;-)

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Object groups are your friend here. Assuming a worst case scenario where your public address block is non contiguous and there is not a direct subnet mapping onto your private subnet, and that your outside access list has the default name of outside_access_in you'll need a configuration along the lines of...

object-group network my-servers_pub
network-object host 1.1.1.1
network-object host 1.1.1.3
network-object host 1.1.1.5
...etc
...etc
network-object host 1.1.1.13
network-object host 1.1.1.15

object-group service my-tcp-ports tcp
port-object eq 21
port-object eq 25
port-object eq 80
port-object eq 110
port-object eq 143
port-object eq 3306

object-group service my-udp-ports udp
port-object eq 53

static (inside,outside) 1.1.1.1 192.168.1.2
static (inside,outside) 1.1.1.3 192.168.1.4
static (inside,outside) 1.1.1.5 192.168.1.7
...etc
...etc
static (inside,outside) 1.1.1.13 192.168.1.14
static (inside,outside) 1.1.1.15 192.168.1.16

access-list outside_access_in permit tcp any object-group my-servers_pub object-group my-tcp-ports
access-list outside_access_in permit udp any object-group my-servers_pub object-group my-udp-ports

I should caveat that this configuration will need some tweaking to work on ASA version 8.3 and above due to some significant changes Cisco have made around natting.

If you're lucky enough to have contiguous public address space, and a 1:1 host mapping you can condense down the object groups & statics into subnets:

object-group network my-servers_pub
network-object 1.1.1.0 255.255.255.240

static (inside,outside) 1.1.1.0 192.168.1.0 netmask 255.255.255.240

You wouldn't even really need the object group for your outside hosts in this scenario, but i've done it that way just to keep it consistent.

share|improve this answer
    
I'm on ASA 8.2, so no problem there. This looks quite concise. Public ips will all map linearly to 172.16.xx.xx dmz. Should do the trick, but I need to test obviously. Evryone gets a +1 so far as everyone is right (in their own way) ;-) –  virtualeyes Oct 13 '11 at 19:33
    
You'll be able to condense it down a bit further with some subnetting then: –  paulos Oct 13 '11 at 20:06
    
gets the nod here, his answer was the most comprehensive and accurate (although it's "network-object", not "network object"). If you have a dmz you'll need to adjust static rule accordingly (e.g. static(dmz,outside) ). Works a charm, thanks everyone! –  virtualeyes Oct 13 '11 at 21:16
add comment

You can use static to map IPs 1-to-1. Like this:

static (inside,outside) 1.2.3.1 192.168.0.1 netmask 255.255.255.255
static (inside,outside) 1.2.3.2 192.168.0.2 netmask 255.255.255.255
static (inside,outside) 1.2.3.3 192.168.0.3 netmask 255.255.255.255

(These could be condensed if the mapping is in order like the example)

Then have a single access list such as:

access-list Outside_In ext permit tcp any any eq 21
access-list Outside_In ext permit tcp any any eq 25
access-list Outside_In ext permit tcp any any eq 53

access-group Outside_In in int Outside

Warning! This will open all the ports to all mapped IPs. If all your servers need these ports anyway, then it's a much quicker configuration.

(Obviously change names of things as is appropriate for your site)

share|improve this answer
    
Ahh, that's better, had been doing acls on per ip basis. Yes, each public ip needs the same ports opened, so not concerned (or at least not as much as relying on ip tables alone without a physical firewall ;-)) Thanks –  virtualeyes Oct 13 '11 at 19:15
add comment

Ok for the access list you can use object-groups to make lump them in together.

object-group network TAG
 network-object 192.168.1.2 255.255.255.255
 network-object 192.168.1.3 255.255.255.255
 network-object 192.168.1.4 255.255.255.255
 network-object 192.168.1.5 255.255.255.255

object-group protocol PROTO_TAG
 protocol-object tcp 80

access-list NAT_ME permit ip object-group TAG eq object-group PROTO_TAG 

static (outside,inside) IP access-list NAT_ME

Fair warning I have not tested this on anything. It's what the documentation says should work.

share|improve this answer
    
I'll have to give that a try, looks reasonable. –  Chris S Oct 13 '11 at 18:11
    
This is a bit more abstract compared to standard ACL + static rule, but if it works, and does so efficiently, I'm game ;-). Going to try Chris' solution first, but both get +1 from here –  virtualeyes Oct 13 '11 at 19:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.