1

I have an ASA 5505 on 8.2 in the field already working. It has two interfaces, LAN/inside and WAN/outside. There is an L2 site-to-site IPSec tunnel configured from the outside interface of the local ASA to the outside interface of a remote F/W (between local internal host .1/32 and remote internal host .1/32).

I want to enable port forwarding for a single port to the outside IP of the local ASA to forward to the internal host .2

If I apply the below configurations at the CLI will this let in the desired traffic without disrupting the IPSec tunnel? I'm new to ASA's and don't want to stop the required ports (UDP 500/4500) from hitting the external interface and the IPSec tunnel coming up or anything like that.

access-list outside_access_in extended permit tcp any interface  outside eq 555
static (inside,outside) tcp interface 555 192.168.0.2 555 netmask 255.255.255.255

There is currently no outside_access_in so if I add this, will it implement an implicit deny any after and stop the IPSec tunnel?

1 Answer 1

0

Almost - you'll need an access-group command too to apply it to the interface's inbound traffic.

And no; the crypto isakmp enable outside that you already have should be all that's needed to keep the VPN up. Consider your current config - assuming your outside interface is the lowest security level, then the policy on that interface is already set to an implicit deny any any.

Maybe flip the switch off-hours, though, just in case there's something about your config that I'm not considering that could break it.

4
  • Hi Shane, thanks for your answer. I have added a link to the config, based on that, do you think this would be the correct command; access-group outside_access_in in interface outside
    – Baldrick
    Jan 27, 2012 at 17:13
  • Yup, that's right. Jan 27, 2012 at 17:29
  • Shouldn't it NAT before it hits the outside interface ACL? Meaning his ACL should be access-list outside_access_in extended permit tcp any host 192.168.0.2 eq 555?
    – resmon6
    Feb 3, 2012 at 16:24
  • 1
    @resmon6 On 8.3 and newer, yes; on 8.2 and older the ACL is evaluated with no knowledge of the impending NAT. Feb 3, 2012 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .