Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I have this ASA5505 setup and pretty much everything works, except a couple key port forwards. Can anybody spot ANY reason why SOME port forwarding would not work? Specifically I know the 50000 & 50001 going to 192.68.0.2 doesn't work. The old linksys home router that was there works with no problem tho. The setup is cable modem -> ASA5505 -> Cisco 2960 -> Computers. Here's my config:

ASA Version 8.2(5)26

hostname URSM-ASA
domain-name ursm.local
enable password xxxxx encrypted
passwd xxxxx encrypted
names
!
interface Ethernet0/0
description Outside Interface
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description Inside Vlan Interface
nameif inside
security-level 100
ip address 192.168.0.254 255.255.255.0
!
interface Vlan2
description ASA Outside Interface
nameif outside
security-level 0
ip address xxx.xxx.xxx.xxx 255.255.255.224
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
domain-name ursm.local
same-security-traffic permit intra-interface
object-group icmp-type DefaultICMP
description Default ICMP Types Permitted
icmp-object echo-reply
icmp-object time-exceeded
icmp-object unreachable
object-group network Local_LAN
network-object 192.168.0.0 255.255.255.0
access-list acl_out remark Outside ACL - Permits Inbound traffic from the Internet
access-list acl_out extended permit icmp any any object-group DefaultICMP
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 51000
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 50000
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 50001
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 3401
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 81
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 8016
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 8200
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 10019
access-list acl_out extended permit tcp any host xxx.xxx.xxx.xxx eq 12088
access-list acl_nonat extended permit ip object-group Local_LAN 10.240.240.0 255.255.255.0
access-list acl_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 45
logging enable
logging timestamp
logging buffer-size 10000
logging buffered informational
mtu inside 1500
mtu outside 1500
ip local pool vpnpool 10.240.240.1-10.240.240.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-649.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list acl_nonat
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) tcp interface 51000 192.168.0.104 51000 netmask 255.255.255.255
static (inside,outside) tcp interface 50000 192.168.0.2 50000 netmask 255.255.255.255
static (inside,outside) tcp interface 50001 192.168.0.2 50001 netmask 255.255.255.255
static (inside,outside) tcp interface 3401 192.168.0.61 3401 netmask 255.255.255.255
static (inside,outside) tcp interface 81 192.168.0.129 81 netmask 255.255.255.255
static (inside,outside) tcp interface 8016 192.168.0.135 8016 netmask 255.255.255.255
static (inside,outside) tcp interface 8200 192.168.0.135 8200 netmask 255.255.255.255
static (inside,outside) tcp interface 10019 192.168.0.135 10019 netmask 255.255.255.255
static (inside,outside) tcp interface 12088 192.168.0.135 12088 netmask 255.255.255.255
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 7:00:00
timeout conn 8:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.0.0 255.255.0.0 inside
snmp-server location URSM
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyn_map 20 set transform-set ESP-3DES-SHA
crypto map vpn_map 65535 ipsec-isakmp dynamic dyn_map
crypto map vpn_map interface outside
crypto ca trustpoint localtrust
enrollment self
fqdn vpn.ursm.net
subject-name CN=vpn.ursm.net
keypair sslvpnkey
crl configure
crypto ca certificate chain localtrust
certificate xxxx
quit
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.0.0 inside
telnet timeout 10
ssh xxx.xxx.xxx.xxx 255.255.255.0 outside
ssh timeout 5
console timeout 0
management-access inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.5.41.40 source outside prefer
ssl trust-point localtrust outside
webvpn
enable outside
anyconnect-essentials
svc image disk0:/anyconnect-win-3.1.02040-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-3.1.02040-k9.pkg 2
svc enable
tunnel-group-list enable
group-policy SSLCLient internal
group-policy SSLCLient attributes
dns-server value 192.168.0.1
vpn-tunnel-protocol svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl_splitTunnelAcl
default-domain value ursm.local
address-pools value vpnpool
group-policy vpnclient internal
group-policy vpnclient attributes
dns-server value 192.168.0.1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl_splitTunnelAcl
default-domain value ursm.local
address-pools value vpnpool
username mmartin password xxxxx encrypted
username mmartin attributes
vpn-tunnel-protocol IPSec svc
service-type remote-access
username admin password xxxxx encrypted privilege 15
username netops password xxxxx encrypted privilege 15
tunnel-group SSLClient type remote-access
tunnel-group SSLClient general-attributes
default-group-policy SSLCLient
tunnel-group SSLClient webvpn-attributes
group-alias SSL_VPN enable
tunnel-group vpnclient type remote-access
tunnel-group vpnclient general-attributes
address-pool vpnpool
default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1123
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect pptp
inspect ipsec-pass-thru
!
: end

share|improve this question
    
have you tried to use wireshark to see if any data is getting forwarded? i had a similar problem and then realised the destination computer had incorrect gateway settings. –  scape Apr 8 '13 at 20:41
    
Could you maybe post the relevant parts of your config rather than pasting the whole thing? No-one here is interested in reading your banner! –  dunxd Apr 8 '13 at 20:51
    
Your port forwards look OK so assuming that your ports and IPs are correct it should work. Are these port for VOIP? if so try disabling inspect skinny from the global service policy. if that's not it try removing inspect sip or h323 h225 or inspect h323 ras. –  GerryEgan Apr 8 '13 at 21:03
    
Sorry for the entire config. I wanted to be thorough, but I understand. I have not tried Wireshark yet. I'm not on-site at them moment, but I'll give that a go. No VoIP at all. The major piece is a time clock app on employee phones that communicates to an internal server. –  mmartin Apr 8 '13 at 21:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.