ASA 5505 OS 9.0端口转发

Question

有一段时间以来，我一直在努力对抗这个问题，我已经尝试了所有我能找到的与我的情况有关的链接。非常感谢您提供的任何和所有的信息。

我要做的是在运行OS9.0的ASA5505上使用TCP和UDP协议将3个端口转发到内部的服务器。它内部也是一个扁平的网络。

服务器地址: 10.10.10.10

端口: 8080 TCP&UDP 9090 TCP&UDP 9191 TCP&UDP

编辑配置很好。

这是我到目前为止所拥有的

ASA Version 9.0(1)
!
hostname XXX
domain-name domain.local
enable password XXX encrypted
passwd XXX encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.10.10.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 40.40.40.10 255.255.255.0
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 8.8.8.8
 name-server 8.8.4.4
 domain-name domain.local
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network SVR
 host 10.10.10.10
object service tcp-8080
 service tcp source eq 8080
object service tcp-9090
 service tcp source eq 9090
object service tcp-9191
 service tcp source eq 9191
object service udp-8080
 service udp source eq 8080
object service udp-9090
 service udp source eq 9090
object service udp-9191
 service udp source eq 9191
access-list 100 extended permit icmp any any echo-reply
access-list 100 extended permit tcp any object SVR eq 8080
access-list 100 extended permit tcp any object SVR eq 9090
access-list 100 extended permit tcp any object SVR eq 9191
access-list 100 extended permit udp any object SVR eq 8080
access-list 100 extended permit udp any object SVR eq 9090
access-list 100 extended permit udp any object SVR eq 9191
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static SVR interface service tcp-8080 tcp-8080
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
nat (inside,outside) source static SVR interface service tcp-9191 tcp-9191
nat (inside,outside) source static SVR interface service udp-8080 udp-8080
nat (inside,outside) source static SVR interface service udp-9090 udp-9090
nat (inside,outside) source static SVR interface service udp-9191 udp-9191
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 40.40.40.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet 10.10.10.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside

dhcpd address 10.10.10.230-10.10.10.240 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 0.0.0.0
username XXX password XXX encrypted privilege 15
!
!
prompt hostname context
no call-home reporting anonymous
: end 

痕量结果

XXX# packet-tracer input outside tcp 8.8.8.8 3456 40.40.40.10 9090

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:
NAT divert to egress interface inside
Untranslate 40.40.40.10/9090 to 10.10.10.10/9090

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group 100 in interface outside
access-list 100 extended permit tcp any object SVR eq 9090
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:
Static translate 8.8.8.8/3456 to 8.8.8.8/3456

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static SVR interface service tcp-9090 tcp-9090
Additional Information:

Phase: 9
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 370, packet dispatched to next module

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

Answer 1

一种方法是在gui。转到顶部的配置，单击左下角的防火墙，然后在列表中选择公共服务器。单击右侧的add。选择您的公共和专用接口、ip地址和端口。ASA将为您构建NATand ACL。