I have an ASA 5505 on 8.2 in the field already working. It has two interfaces, LAN/inside and WAN/outside. There is an L2 site-to-site IPSec tunnel configured from the outside interface of the local ASA to the outside interface of a remote F/W (between local internal host .1/32 and remote internal host .1/32).

I want to enable port forwarding for a single port to the outside IP of the local ASA to forward to the internal host .2

If I apply the below configurations at the CLI will this let in the desired traffic without disrupting the IPSec tunnel? I'm new to ASA's and don't want to stop the required ports (UDP 500/4500) from hitting the external interface and the IPSec tunnel coming up or anything like that.

access-list outside_access_in extended permit tcp any interface  outside eq 555
static (inside,outside) tcp interface 555 555 netmask

There is currently no outside_access_in so if I add this, will it implement an implicit deny any after and stop the IPSec tunnel?


Almost - you'll need an access-group command too to apply it to the interface's inbound traffic.

And no; the crypto isakmp enable outside that you already have should be all that's needed to keep the VPN up. Consider your current config - assuming your outside interface is the lowest security level, then the policy on that interface is already set to an implicit deny any any.

Maybe flip the switch off-hours, though, just in case there's something about your config that I'm not considering that could break it.

  • Hi Shane, thanks for your answer. I have added a link to the config, based on that, do you think this would be the correct command; access-group outside_access_in in interface outside – jwbensley Jan 27 '12 at 17:13
  • Yup, that's right. – Shane Madden Jan 27 '12 at 17:29
  • Shouldn't it NAT before it hits the outside interface ACL? Meaning his ACL should be access-list outside_access_in extended permit tcp any host eq 555? – resmon6 Feb 3 '12 at 16:24
  • 1
    @resmon6 On 8.3 and newer, yes; on 8.2 and older the ACL is evaluated with no knowledge of the impending NAT. – Shane Madden Feb 3 '12 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.