Lessons Learned - Cisco ASA 5510 and TCP request discarded

Hi there,

Some weeks ago, I mentioned having had some trouble trying to figure out why a Cisco ASA would allow traffic TO the interface (ie, for using SSH) and not THROUGH the interface (to reach a server on the LAN, from the outside). I also mentioned the solution there: when permitting traffic through the outside-interface, always mention "interface" in the static-statement instead of the IP-address.

Today, I ran into this problem again. But, slightly different this time (of course). The previous time, we were dealing with a single public IP address setup in a SOHO office. So, the customer had only one public IP address. My conclusion after troubleshooting that setup was, that you cannot use the exact public IP but have to use the "interface"-keyword instead.

This time, this customer does really have a business internet setup, with a routed subnet on the outside. Because I have multiple static's in this config, I decided to use the real public IP address in the static-statement, for reasons of clarity and readability. But that DOES NOT WORK.

Remember this: when using a Cisco ASA firewall, and using port forwarding to configure inbound traffic, ALWAYS (always!!) use the "interface"-keyword in the static-statement. So, something like:

  • static (inside,outside) tcp interface [port] [private IP] [port]

That works!

Regards, Rene

Reacties

Een reactie posten

Populaire posts van deze blog

Lessons Learned - Cisco ASA 5505 and TCP request discarded

Hi there, Last week, we set up a Cisco ASA 5505 firewall in one of our customers' LAN. It should replace the ISA 2000 firewall over there, because we need to create a site-to-site tunnel to a PIX 515E on a remote location. All went fine with this ASA 5505, except that it would not pass any traffic from the internet to the LAN. From the inside out, all was OK. From the outside in, nothing would pass the firewall. The relevant config lines were as follows: static (inside,outside) tcp w.x.y.z 25 10.10.10.10 25 netmask 255.255.255.255 access-list outside01 permit tcp any host w.x.y.z eq 25 access-group outside01 in interface outside So, here we redirect all SMTP traffic on public interface with IP w.x.y.z to private host 10.10.10.10. Nothing much would happen. Internally, the SMTP host was listening, of course. From outside, the interface with IP w.x.y.z was pingable, of course. From the outside, configuring the ASA with SSH or HTTPS went fine. (So, traffic TO the
Meer lezen

Change the default telnet client

Enable handling of telnet://hostname:port/ URLs on the command line. With this feature, you can now set PuTTY as the default handler for Telnet URLs. If you run the Registry Editor and set the value in HKEY_CLASSES_ROOT\telnet\shell\open\command to be "\path\to\putty.exe %1" (with the full pathname of your PuTTY executable), you should find that clicking on telnet links in your web browser now runs PuTTY.
Meer lezen

Printing to LPD Printer Is Slow or Fails with Windows

Experienced a nasty printing problem, which was caused by a number of ingredients that together will make it very odd that someone else will ever experience this problem, but anyway: here's the story... At a customer's site, we implemented new industrial labelprinters (Zebra's, very fine machines). Per label printing went fine to these printers, but printing a higher number of labels (> 10) showed a strange phenomenon: a number of labels printed fine, the system waited for a couple of minutes, then some labels again, then some minutes waiting again and so on... Very strange, but more important: very irritating! Other relevant infrastructure components: SAP R3 on Windows 2000 Server, printing to LPR-printers on the 2000-box, which in turn delivers the label on a print server (running Teklynx Sentinel S4 Print Pack for adding barcode functionality etc.). On this print server, the label processing is carried out and at last the label is delivered to the labelprinter. Quite
Meer lezen