Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to open a hole in the firewall (ASA 5505, v8.2) to allow external access to a Web application. Via ASDM (6.3?), I've added the server as a Public Server, which creates a static NAT entry [I'm using the public IP that is assigned to 'dynamic NAT--outgoing' for the LAN, after confirming on the Cisco forums that it wouldn't bring everyone's access crashing down] and an incoming rule "any... public_ip... https... allow" but traffic is still not getting through. When I look at the log viewer, it says it's denied by access-group outside_access_in, implicit rule, which is "any any ip deny"

I haven't had much experience with Cisco management. I can't see what I'm missing to allow this connection through, and I'm wondering if there's anything else special I have to add. I tried adding a rule (several variations) within that access-group to allow https to the server, but it never made a difference. Maybe I haven't found the right combination? :P

I also made sure the Windows firewall is open on port 443, although I'm pretty sure the current problem is Cisco, because of the logs. :)

Any ideas? If you need more information, please let me know.


Edit: First of all, I had this backward. (Sorry) Traffic is being blocked by access-group "inside_access_out" which is what confused me in the first place. I guess I confused myself again in the midst of typing the question.

Here, I believe, is the pertinent information. Please let me know what you see wrong.

access-list acl_in extended permit tcp any host PUBLIC_IP eq https  
access-list acl_in extended permit icmp CS_WAN_IPs any  
access-list acl_in remark Allow Vendor connections to LAN  
access-list acl_in extended permit tcp host Vendor any object-group RemoteDesktop  
access-list acl_in remark NetworkScanner scan-to-email incoming (from to PCs)  
access-list acl_in extended permit object-group TCPUDP any object-group Scan-to-email host NetworkScanner object-group Scan-to-email  
access-list acl_out extended permit icmp any any  
access-list acl_out extended permit tcp any any  
access-list acl_out extended permit udp any any  
access-list SSLVPNSplitTunnel standard permit LAN_Subnet  
access-list nonat extended permit ip VPN_Subnet LAN_Subnet  
access-list nonat extended permit ip LAN_Subnet VPN_Subnet  
access-list inside_access_out remark NetworkScanner Scan-to-email outgoing (from scanner to Internet)  
access-list inside_access_out extended permit object-group TCPUDP host NetworkScanner object-group Scan-to-email any object-group Scan-to-email  
access-list inside_access_out extended permit tcp any interface outside eq https

static (inside,outside) PUBLIC_IP LOCAL_IP[server object] netmask

access-group inside_access_out out interface inside  
access-group acl_in in interface outside
access-group acl_out out interface outside

I wasn't sure if I needed to reverse that "static" entry, since I got my question mixed up... and also with that last access-list entry, I tried interface inside and outside - neither proved successful... and I wasn't sure about whether it should be www, since the site is running on https. I assumed it should only be https.

share|improve this question
Could you post a "sanitized" config file with IP addresses using internal space and passwords blanked out? – Jeff Ferland Jul 6 '12 at 12:22
The inbound ACL on the outside interface is missing a rule to allow the traffic. – Paul Ackerman Jul 6 '12 at 13:56
up vote 1 down vote accepted

Uh yearh probably it's CISCO fault. Honestly for me ASDM it's a bit confusing so I will pass you the command lines directive:

[type cisco password]
[retype password]
show conf <- retrieve the config plain text

Now you should have lines like that

access-group outside_access_in in interface outside
access-list outside_access_in extended permit tcp any interface outside eq www

Maybe the access-list name is different, but doesn't matter. Also in my case the outside interface it's an alias for the VLan2 on which is the internet connected. This allows traffic for www connection to be accepted.

Now for the port forwarding you need a line like that:

static (inside,outside) tcp interface www LOCAL_IP www netmask

Again the inside it's an name for my local interface, which act as an gateway for the network. If you con't have lines like that just add them with configure terminal. Add the magic lines and should work. If you need any help in the console just use the magic ?:)

share|improve this answer
Thanks, I'll give it a shot. – White Island Jul 7 '12 at 19:29
I'm sorry, I got my question backwards (apparently, inside_access_out is blocked). I've posted an update, as I was unable to convert your answer to my scenario. :P – White Island Jul 10 '12 at 1:51
I was told on the Cisco forums to remove the inside_access_out group. I was nervous about doing that (not sure about any other ramifications), so I resolved this by adding 'any any https allow' on that access group. There is probably a better way of doing this, but I tried all combinations I could think of (server_ip as source, destination, etc... even if it didn't necessarily make sense - thought I might get lucky :P) with no success. With the 'any any' it's working. Thanks for the help! – White Island Jul 11 '12 at 13:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.