Firewall – Cisco ASA Port Forwarding for Newbies

ciscocisco-asafirewallnetworkingremote-access

I'm a contractor for a private school where I'm tasked with developing a public API to their database to use in mobile apps.

They host their own website on school premises and their network is controlled by a Cisco ASA 5510 running CLI 8.2.

They are providing me with a dedicated blade server and a static IP for this project, so I asked the SysAdmin to map the IP to the machine, and also to open port 80 and port 22 access to it.

In the end, the guy said he tried what he could, but it didn't seem to work. He's clearly not the one who configured their systems, and I have zero experience with Cisco, so I'm hoping someone here can point me in the right direction.

Here is the output of the 'show run' command that he sent me: http://pastebin.com/ikdSRg7j . The machine we're trying to open up but doesn't work ends with 211, and their website which is working fine is 209.

I know there are a lot of questions about Cisco ASA Port Forwarding on ServerFault, but even after reading the ASA manual, I have so little experience with the device that the answers don't help me much. My apologies and my thanks in advance.

Best Answer

Step 1: Fix this problem... related to acl_out referenced by access-group acl_out in interface Outside

! ... more acl lines above
access-list acl_out extended permit tcp any host 222.22.2.215 eq 3389
            ^^^^^^^
access-list acl-out extended permit tcp any host 222.22.2.210 eq www
access-list acl-out extended permit tcp any host 222.22.2.210 eq ssh
access-list acl-out extended permit tcp any host 222.22.2.211 eq ssh
access-list acl-out extended permit tcp any host 222.22.2.211 eq www
            ^^^^^^^

acl-out is not the right name. You should be using acl_out

Please add the following lines to the bottom of the acl using the ASA CLI and test again:

access-list acl_out extended permit tcp any host 222.22.2.210 eq www
access-list acl_out extended permit tcp any host 222.22.2.210 eq ssh
access-list acl_out extended permit tcp any host 222.22.2.211 eq ssh
access-list acl_out extended permit tcp any host 222.22.2.211 eq www
Related Topic