ASA 5505 Configuration Problems

You have created the NAT statement, but you now need to create an ACL to allow packets to the host.

access-list outside_access_in extended permit tcp any host 10.1.1.20 eq 3389

access-group outside_access_in in interface outside

In the access-list you could probably also use:

access-list outside_access_in permit tcp any interface eq 3380

I don't know if it matters, but you did not 'switchport' vlan 1 against any ports, the way you did vlan 2. And do you really want the outside interface to be a tagged vlan?

That would only work if both the source and destination port as 3389. Possible for udp -- but on the other hand the last time I checked, RDP was TCP, not UDP, and for the TCP case, you would *not* want to restrict the source port to 3389.

Also, in an ACL being applied to the outside interface, the destination IP needs to be the IP *before de-nat*, the public IP. Like the other poster indicated, you probably want 'interface' there instead of 'host 192.168.1.2' . You might need to use 'interface outside' -- at least that's what you would need for PIX 6.2/6.3

Still doesn't work. I must be missing something.

^^^ that should read eq 3389

can you post the contents of sh access-list and sh nat ...

=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ^^^ that should read= eq 3389

sh access-list

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max

sh nat

NAT policies on Interface inside: match ip inside any inside any dynamic translation to pool 1 (No matching global) translate_hits =3D 0, untranslate_hits =3D 0 match ip inside any outside any dynamic translation to pool 1 (10.1.1.20 [Interface PAT]) translate_hits =3D 0, untranslate_hits =3D 0 match ip inside any _internal_loopback any dynamic translation to pool 1 (No matching global) translate_hits =3D 0, untranslate_hits =3D 0

NAT policies on Interface outside: match ip outside host 10.1.1.20 inside any static translation to 192.168.1.2 translate_hits =3D 0, untranslate_hits =3D 0

You cannot static your entire outside interface to the inside. When you are dealing with your outside interface, static only the ports you need.

You have likely also reversed the order of the interfaces for the static.

Thirdly, you need to use the keyword 'interface' instead of the outside IP address.

Fourthly (if I recall correctly) you are attempting to configure RDP on UDP, but RDP is a TCP protocol. With UDP it might make sense to lock the source port to 3389 but with TCP it does not.

static (inside,outside) tcp interface 3389 192.168.1.2 3389 netmask

access-list outside_access_in extended permit tcp any interface outside eq 3389

access-group outside_access_in in interface outside

Walter,

Thanks for the help. I had messed up my config, so I reset the ASA to factory default, did a basic configuration using the setup wizard, then used your commands to configure NAT and the ACL and it worked just fine.

Do I need to make a service group to allow other services such as smtp, pop3 etc or just add lines to my ACL and NAT entries?

Thanks again.

Either way works fine.

The time we started creating object groups was when we started doing mass blocking of problematic IP source addresses. Updating them one by one in the config was a pain, but updating the object group was fairly easy.

Eventually we started using object groups extensively, which was in the context of an PIX configuration generator that I wrote that allowed me to create configuration templates and couple of small host-specific files, and use the templates to generate