Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a contractor for a private school where I'm tasked with developing a public API to their database to use in mobile apps.

They host their own website on school premises and their network is controlled by a Cisco ASA 5510 running CLI 8.2.

They are providing me with a dedicated blade server and a static IP for this project, so I asked the SysAdmin to map the IP to the machine, and also to open port 80 and port 22 access to it.

In the end, the guy said he tried what he could, but it didn't seem to work. He's clearly not the one who configured their systems, and I have zero experience with Cisco, so I'm hoping someone here can point me in the right direction.

Here is the output of the 'show run' command that he sent me: . The machine we're trying to open up but doesn't work ends with 211, and their website which is working fine is 209.

I know there are a lot of questions about Cisco ASA Port Forwarding on ServerFault, but even after reading the ASA manual, I have so little experience with the device that the answers don't help me much. My apologies and my thanks in advance.

share|improve this question
Do you have access to the https user interface (ASDM)? – ewwhite Jul 5 '12 at 6:26
The sysadmin usually telnets in, but yes I think have access to the ASDM. – manglewood Jul 5 '12 at 7:41
Stick with the CLI, you'll get more "consistent" results. =] – Chris S Jul 5 '12 at 12:42
@chriss I think for small businesses, less-complicated setups and for admins coming from other firewall products, using the ASDM web-GUI is readable and provides better results. – ewwhite Jul 5 '12 at 13:22
up vote 1 down vote accepted

Step 1: Fix this problem... related to acl_out referenced by access-group acl_out in interface Outside

! ... more acl lines above
access-list acl_out extended permit tcp any host eq 3389
access-list acl-out extended permit tcp any host eq www
access-list acl-out extended permit tcp any host eq ssh
access-list acl-out extended permit tcp any host eq ssh
access-list acl-out extended permit tcp any host eq www

acl-out is not the right name. You should be using acl_out

Please add the following lines to the bottom of the acl using the ASA CLI and test again:

access-list acl_out extended permit tcp any host eq www
access-list acl_out extended permit tcp any host eq ssh
access-list acl_out extended permit tcp any host eq ssh
access-list acl_out extended permit tcp any host eq www
share|improve this answer
Yes, that's exactly what it is was. A typo in the access-list name. Seems so obvious in hindsight it smarts. Anyway, I hope this helps some other Cisco CLI newbie. – manglewood Jul 12 '12 at 1:57

The prototypical setup (make sure you're in enabled mode):

There should be some access-list on the outside interface which controls what traffic can enter the network. It's possible that it doesn't exist already, but if you have any inbound rules already it will be there.

To check if you have such an access-list, run

show run access-group

It should return something like

access-group Internet_In in interface Internet

This means (reading right to left) that traffic to the "Internet" interface (that's an interface with nameif Internet as shown in show run int), inbound traffic, must pass access-list "Internet_In".

You can display this access-list with:

show run access-list Internet_In access-list Internet_In extended permit tcp any host ${Public_IP} eq ${Public_Port}

That second line will generally appear many times, for each IP and Port combination being forwarded in. Figure out what lines your missing. If you don't have an access group at all, you really should have one for security sake. Usually you'll just be missing a line or three from the access-list.

To add lines to the access list, enter configuration mode with conf t, then type out what lines you want in the access-list in the exact same format as shown previously.

Once you've allowed the traffic in, the ASA needs to know where it goes if you're running NAT. The static command maps traffic backward across a NAT interface. If you're not using NAT at this ASA, then you don't need to worry about this mapping (show run nat will display the NAT configuration).

To bring up the existing static configuration run:

show run static

It should return something if you have mapping setup already, like:

static (inside,Internet) tcp ${Public_IP} ${Public_Port} ${Priv_IP} ${Priv_Port} netm

Where "inside" and "Internet" are the nameif of interfaces and the rest is fairly self explanatory. Again, figure out what lines you're missing, add them in configuration mode.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.