With an ASA 5520 port forwarding

Similar Questions

• VPN site to Site with an ASA behind Port Forwarding device

  Hi, I want to configure a VPN from Site to site with an ASA with a public static IP adress and other ASA located behind a device with a public IP address that can forward ports to the ASA.

  I have found no documentation for this configuration in the Cisco KB, anyone have a link for me or a brief description of the requirements?

  Thank you

  Tobias

  Hello

  Take a look at this documentation

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094ecd.shtml

  Hope this helps

  -Jouni

• with vlc and wvc54c port forwarding

  I have an old wvc54c work with vlc through the LAN, but it won't work from WAN through a port forward.

  I have installation of redirection of WAN port correctly with airport extreme - I have other new wvc54gcn cameras that operate through thin WAN but the same exact transfer configuration (changing only the local ip address) will not work with the former wvc54c.

  What's wrong with the new WVC54gcn but the more wvc54c? Is there a work around I should use?

  I tried using port 1024 instead of 80, as suggested by some other posts here.

  Thanks for any clarification!

  OK, I thought about it. When installing the camera, I had not put something in the primary 'gateway' or 'dns '. I put them both to the IP of the router and who nailed him.

  Thanks for the help!

• Routing with Cisco ASA 5520 VPN

  I have installed IPsec vpn remote users in the Cisco ASA 5520 using RADIUS in my main network. Works very well. I have a site to my Cisco ASA5520 tunnels going to other sites, some of the tunnels have Cisco ASA and some have SonicWalls. I wish that my users VPN remote IPSec to be able to navigate in these tunnels is a site to access remote subnets attached to these tunnels. Do I need to use a combination of routing and the ACL? Or can I just use ACL only? Or just use routing only?

  Thank you

  Carlos

  Hello

  The key to set up here is the two ACL of VPN L2L end points that determine the 'interesting' traffic to connect VPN L2L. You will also need to confirm that the connection of the VPN Client is configured so that traffic to the remote sites have sent to the connection of the VPN client. There are also other things that you should check on your ASA plant

  Here most of the things you usually have to confirm

  • Set up 'permit same-security-traffic intra-interface' if it is already present in your configuration
    • This setting will allow connections to form between the hosts that are connected to the same interface on the ASA. In this case, applies because the VPN client users are connected to the interface 'outside' of the ASA and also remote sites are connected to the ASA to "external". If the traffic between the remote VPN Client and VPN L2L sites will be to enter and exit the same interface
  • You will need to check how the customer if configured VPN connection. Split or full Tunnel tunnel
    • If the connection of the VPN Client is configured as Split Tunnel then you need to add all the networks from the remote to the Split Tunnel, so that the connections between the VPN Client is transmitted to the ASA and from there connections VPN L2L
    • If the connection of the VPN Client is configured as full Tunnel, then there no problem that all traffic is transferred to the Client VPN connection all its assets
  • Define the VPN pool in the ACL of VPN L2L
    • You should make sure that the pool network VPN Client is defined in the ACL that define 'interesting' traffic to connect VPN L2L. So, you need to add the pool VPN VPN L2L configurations on the sites of Central America and remote control
  • Configure NAT0 / NAT exempt for remote VPN Client to L2L VPN Site traffic at both ends of the VPN L2L
    • You must ensure that the NAT0 / exempt NAT rules exist for the VPN Client for Remote Site traffic. This will have to be configured on the SAA "outside" interface. Format of configuration varies naturally a bit on the ASA Central his software level.

  These should be the most common things to set up and confirm for traffic to flow between the VPN Client and Remote Sites

  Hope this helps please rate if yes or ask more if necessary.

  -Jouni

• With several cameras WVC54GCA port forwarding

  I have four cameras WVC54GCA and I can't get to work on the fourth for internet access to the camera port translation. The first three ports are using ports 80 and 8000, 8080 and works very well. My router is a WRT54GS (firmware c. 7.50.6). I tried many other ports for the fourth camera but all results in a "Connection refused" message. The fourth device is configured exactly as the others and works fine when I use one of the three ports assigned to the other cameras. Any suggestions on what could be the cause or a port that works would be appreciated.

  My ISP is Rogers the Canada.

  Thank you

  I don't understand why I can't get ports in the range 1024 and up to work but I stumble on a suggestion for 7070 and it works. Which leaves me with all four cameras working outside on ports 80 and 8000, 8080-7070. That solves my immediate problem, but has yet to determine why I couldn't just specify the ports to open. Who will have to wait until the next problem arises.

  Thanks to all who have contributed.

• ASA 5520 8.0 (4) port depending on the ACLs vpn works not

  Hi all

  I have a problem with an ASA (5520 8.0 (4)) for lack of working with a port based acl for remote clients. I have a simple acl from a single line to split traffic, if I allowed the tunnel IP works fine, if I lock it up to TCP 3389 rdp will not work. I don't see anything in the logs and debug output, I did have a problem with a similar configuration (5510 8.0 (4) and I'm at a loss to explain it.)

  Everyone knows about this problem before? I have nat exclusions etc and as I said, the tunnel only works if the acl permits all IP traffic between client and server.

  THX in advance

  Split-tunnel list cannot IP, if you want to restrict which ports are are sent via the tunnel vpn for your clients vpn, you need to use VPN filters under Group Policy:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

• The ASA with crossed VPN Port forwarding

  Hello

  I worked on a question for a while and I have managed to track down the issue, but I don't know how to solve the problem.

  I have an ASA 5505 8.4 (7) running with a tunnel for incoming remote users anyconnect vpn. I also want to configure incoming Web server port forwarding.

  The question seems to be traversed rule which stops incoming port forwarding:

  NAT (outside, outside) NETWORK_OBJ_172.16.1.0_28 interface description dynamic source hairpin to natting users vpn on the external interface

  When I disable the port forwarding will work perfectly (according to tracer packet that is).

  I have attached the config to this post. I would appreciate any idea how to get the through VPN and the transfer to the incoming port working.

  The config has been condensed to remove unneed config.

  Thank you

  Hello

  What is the configuration commands, you use to put in place the static PAT (Port Forward)?

  The problem is most likely order of the NAT configurations such as configuring NAT above in the upper part of the NAT configurations.

  Configuring static PAT, that you could use to make it work would be

  the SERVER object network

  host

  service object WWW

  tcp source eq www service

  NAT (server, on the outside) of the interface to the static SERVER 1 source WWW WWW service

  The above assumes the source for the host interface is "Server" and the service that you want to PAT static TCP/80.

  Note that we add the number '1' in the 'nat' command. This will add at the top. The same should be done for any other static PAT you configure you want for these VPN Clients.

  Hope this helps

  -Jouni

• Configure an FTP server behind ASA 5505, need some sort of port forwarding

  My company uses a Cisco ASA 5505 Adaptive Security Appliance, and I'm trying to set up an SFTP server which is accessible from the Internet.

  Is it possible to simply configure port forwarding to my FTP port (4610) to the IP with the server, as I would on a simple Linksys router? Or I have to put in place a sort of demilitarized zone?

  Any help would be greatly appreciated.

  No, you do not necessarily have a demilitarized zone, inside works perfectly. I guess you want to use the ip address of the external interface of the ASA for this? If so, it would looks something like this. Where x.x.x.x is the ip address of the inside/private of the ftp server.

  public static 4610 4610 netmask 255.255.255.255 x.x.x.x interface tcp (indoor, outdoor)

  outside_access_in list extended access permit tcp any interface outside eq 4610

  Access-group outside_access_in in interface outside

• Need help with the port forwarding for a XBox remote Streaming

  I have a router R6200v2 and need help with port forwarding.

  I came across this set of instructions for setting up stream port forwarding XBox remotely from anywhere

  http://kinkeadtech.com/2015/07/how-to-stream-Xbox-one-to-Windows-10-from-anywhere-with-Internet/

  I have no idea when it comes to such things and I want to make sure I do it correctly without messing up my existing home network.

  Port Forwarding and triggering Port pages setup look very different from what the guy uses. Can someone walk me through what I do to set up please?

  Hi @varxtis,

  You must enter them in the field for a start external Port and external completion Port. You will need to send individually except for the range of 49000-65000. The steps are as follows.

  1. create a Service name (it could be something else that you cannot use the same service name twice. Ex. XBOX1, XBOX2 and so forth.)

  2. Select the type of service (TCP, UDP or both)

  3 entry 5050 times a start external Port and external endpoints.

  4. Select the IP address of your XBOX.

  5. Select apply.

  6 do the same for other port numbers. To the beach, use 49000 for the external departure Port and for the external completion Port 65000.

  Kind regards

  Dexter

  The community team

• Implementation of IPSec Port Forwarding on a Windows 2012 with a LRT224 Server

  Hi all I hope someone can help me validate my troubleshooting. I'm deploying a Server Windows 2012 that will server as a server vpn for customers. In place is a LRT224 with 4 VLANS set up. I have enabled port forwarding for IPSec (UDP/500), L2TP (UDP/1701) and L2TP (UDP/4500) to go on the server.

  In my Initial test, I put the LRT224 on the same network as the client of my test and realized the Test Client (10 Windows) to try to connect to the WAN of the LRT224 interface. I get this message:

  

  Thinking it could be the configuration of the server, I then put the client system on the same vlan on the LRT224 server. When I tried to connect to it directly by using the IP address of the server as a destination, he succeeded.  It is leading me to believe that it is the LRT224.

  I confirmed that VPN passthrough is enabled.

  The firmware version is by: v1.0.5.03 (February 22, 2016 10:12:17)

  Currently, the firewall is disabled (I would activate once I'm working)

  If anyone has ideas or notice a fault in my tests, I would really appreciate the feedback.

  If additional information would be useful, please let me know what you want and I can work for it.

  Thanks to all in advance.

  FreeFallFour wrote:

  I then put the client system on the same vlan on the LRT224 server. When I tried to connect to it directly by using the IP address of the server as a destination, he succeeded.  It is leading me to believe that it is the LRT224.

  It does normally not as I KNOW because the VPN in an outside in the process. You should test the VPN connection outside the server's IP subnet.

  You have the server configuration that the DNS server in the router to DHCP with DNS Proxy is disabled?

  Are you doing load balancing Internet connection?

• Setting up Port Forwarding on router WRT54G, working with a WVC54GCA Wireless CAmers

  I have the equipment in question and you need to know a few things when it come to put in place for Internet access. Before I aske the question, however, I have the following IP addresses associated with this project: WVC54GCA - 192.168.2.102, router WRT54G - 192.168.2.1, the questions are:

  1. How do you define Port Forwarding on every element.
  2. Should the two articles have static IP addresses.
  3. Once the port forwarding is set, what is the structure of the URL to access the camera?

  Any help would be appreciated, summer tear my hair on it. Seems simple, but obviously not. I'm missing something.

  Thank you

  For port forwarding, you will first need to set the camera to a fixed LAN IP address (static).

  If your router uses the range of 192.168.2.100 thanks 192.168.2.149 DHCP servers, then 192.168.2.102 is an unauthorised fixed address.  With the Linksys routers, any fixed LAN IP address must be outside the range of the DHCP server.

  Here are the rules of use of the fixed LAN IP addresses with Linksys routers.  (Note: these rules were written for the 192.168.1.x subnet.)  Since you're using the 192.168.2.x subnet, change all addresses accordingly):

  With Linksys, routers, a fixed (static) IP LAN addresses must be assigned in the device that uses the address. If you need to enter the fixed address to the computer, printer or camera, not in the router.

  When you use a Linksys router, any fixed LAN IP address must be outside the DHCP server rank (typically 192.168.1.100 thru 192.168.1.149), and may not end with 0, 1 and 255.

  That's why any fixed LAN IP address would normally be of the order of
  192.168.1.2 thru 192.168.1.99 or
  192.168.1.150 thru 192.168.1.254
  assuming that you always use the default DHCP server line.

  In addition, in the computer, when you configure a static LAN IP address, you need to set the "Subnet mask" 255.255.255.0 and the 'default gateway' on 192.168.1.1 and "DNS server" to 192.168.1.1.  Note that some network devices can not use server proxy DNS at 192.168.1.1.  In this case, the value "DNS server" your real address of Internet DNS server (found in the router when connected to the Internet).

  It is also important that the same value static LAN IP address no two devices on your network.

  **********************

  After you gave your camera at a fixed LAN IP address, then go in "Port Redirection" in the router and configuring the ports one (or more) to the address LAN IP fixed camera.

  In order to access your camera from the Internet, you will need to either:

  (1) get a fixed Internet IP address (static) address from your ISP and configure your router to use this address, or

  (2) use a free service such as DDNS.  DDNS allows you to use a dynamic Internet IP address, but can connect you by using the same URL.

  I hope this helps.

• Problem setting up Port Forwarding with two routers.

  I can't set up by Linksys RT31P2 and routers port forwarding WRT160Nv3.

  My setup is Webstar Modem = RT31P2 = WRT160N = Mac OS 10.6.5. (No configurable modem and ISP do not prevent port forwarding. It comes with two Linksys routers).

  I had a Monty Python-going around with the support of Cisco cat; and follow up with telephone assistance in which the agent knew nothing about port forwarding and his supervisor expressed the view that it was not possible with two routers. Sigh.

  If anyone can help me with step by step specific and simple instructions to configure routers. I know that the basic procedures. I'm not clear, what exactly changes on routers.

  I read that portforward.com has to say and it does not work so I must be misunderstanding something.

  The ip address of my computer is 192.168.1.103.  Are the last three digits of this speech concluded the two routers in the area on the port forwarding page? What other changes should be done what router?

  I know the port numbers that I use are OK because I can implement successfully if I connect to one or other of the routers (but not both), and my software of p2p shows port are open.

  Any help and suggestions most welcome.

  If you set up as I have suggested that you have only a single LAN that will be using in your addresses * 192.168.15 case. So in your case:

  1. change the address LAN IP of 192.168.1.1 to 192.168.15.2 WRT.
  2 disable the DHCP server.
  3. connect the LAN of the WRT port to port LAN of the RT.

  That's all. Disable the DHCP server will not affect whatever it is that you're connected LAN - LAN and DHCP server on the RT is still operational.

  After the change, previously the WRT computers may require a reboot to get a new address 192.168.15. *.

  Your computer to which you are transferring must have an IP static and not dynamic (or variable). Check the current IP information on this computer. It must have an IP address like 192.168.15.103, mask 255.255.255.0, gateway 192.168.15.1 subnet and DNS 192.168.15.1 server or maybe two other IP addresses instead. Note DNS servers if you do not 192.168.15.1.

  Then configure a static IP address on the computer. Use something like 192.168.15.10, 255.255.255.0 gateway 192.168.15.1 and the DNS servers you found before.

  After this implement 192.168.15.10 port forwarding.

• Problems with WRT610N v2 + WAG54GS v1.0 of port forwarding

  Background:

  I have a WAG54GS v1.0 (Appendix A) that I use to manage my home network and my ADSL connection. I bought a WRT610N v2 (which I will refer to as the router) with the intention that he would replace the functions of networking of the WAG54GS (which I will call the modem), who could be relegated to handling just the Internet connection. Both are running their latest firmware.

  I got this configuration to work, but with a problem: I lost a lot of flexibility with regard to port forwarding. The problem is the only way I managed to get the Internet to work with the 192.168.0.1 router and the modem to 192.168.1.1. If I try and that you have both 192.168.0.x or 192.168.1.x then connect to Internet no longer works under any configuration options, I've tried.

  What wants to say that when I go to port forwarding of installation in the modem, I can only forward to clients on 192.168.1.x, but the router can only transmit to 192.168.0.x. The only things that I can go to work are situations where triggering serial port can be applied, so that when a connection is made to the relevant port to an external IP address, and then this external IP address to communicate on this port. As you can guess this covers almost all cases.

  Question:

  Would it not be possible to have the router and the modem on 192.168.0.x or 192.168.1.x, allowing port translation work as expected. Which should in principle be possible with the modem bridge mode except that it is impossible to configure the PPPoA settings needed to connect to my ISP.

  Or I'll have to rethink the configuration of the network (i.e. buy a dedicated ADSL modem and remove entirely my WAG54GS?)

  In fact in the end what I figured out was that according to my WRT610N concerned my WAG54GS is my ISP and that was all he needed to know on the Internet connection. So I had to connect to the WAG54GS with an IP address static, stuck that IP in the DMZ of the WAG54GS and left the WRT610N to manage port forwarding like all devices that connect will make it through that. (Yes, I've disabled features wireless of the WAG54GS)

  I'm reasonably sure that I tried the combination of settings you suggested (including moving the WAG54GS off the Internet port on the WRT610N, which I wanted to avoid in any case as I have four devices permanently connected in any case) and found that it still does not. And I wasn't saying two to 192.168.1.1 set at any point, my darkened auto focus was that change only the last block of the IP address doesn't have to work for Internet access.

• Problems with static IP setting for the port forward through 2 routers

  I currently have cable internet connected to a router (Linksys E2000 w / v1.0.03 firmware). This router is connected to another router, a Linksys E3200 with firmware v1.0.02. In order to correctly forward ports through the E3200, I understand that I need to set up a static IP address on the router.

  I almost followed the steps in this video, but when I enter all the IP addresses for the static IP address settings, it allows me to access the router configuration page. I try to get the new IP address that I gave (which he tries to move automatically once I have save settings) and the connection times out. I am able to access internet otherwise, however. From here, I have to do a factory reset on the router and start from square one.

  Anyone have any ideas? I'm quite frustrated and would like to get ports forwarded so I can get my server properly set in place.

  1. If it has connected LAN - LAN you will need to disable the DHCP server on the E3200.

  2. the best option would be to use the 'bridge' on the E3200 mode (in the latest firmware) and connect the internet port to the main router.

  3. If connected LAN - LAN (or in Bridge mode) all internet related functions on the E3200, including ports are not relevant. There is no need to set up the port on the E3200 redirects. All shipping is done only on the E2000 and nowhere else.

  4. What is the address LAN IP of the E3200? What is the address LAN IP of the E2000?

• Problem with Port Forwarding (When PPTP is upward) in the WRT-160N

  Hello world!

  I'm looking for more help with Port Forwarding in my new Linksys router. I bought the daysago afew router and was pretty surprised when I discovered that there is no DD - WRT firmware is installed in it (the router was 100% NEW when I bought it). I downloaded latest firmware original and flashed Linksys file successfully.

  But I still have the problem (even that I was on DD - WRT firmware too) with the port forwarding for my DC ++ and Vuze (app from torrents): I wrote port forward for ports 49151 (for Vuze) and 4000 (for DC ++) to pass on to my desktop computer (IP 192.168.1.201) - I saw a post on this forum, that there could be a problem If you transfer to an IP address, which is within the local area of DHCP, so I forwarded to IP.201 (my local DHCPzone is 192.168.1.100-. 149) But does not forwardind (())

  What's wrong?

  My configuration:

  Router IP: 192.168.1.1

  PPTP (I my ISP)

  IP address: 192.168.226.127

  Default gateway: 192.168.226.2

  DNS 1: 192.168.1.1

  2 & 3 DNS: 0.0.0.0

  The IP address of the PPTP server: 192.168.226.2

  User name: *.

  Password: *.

  _____________________

  Simple Port Forwarding:

  Name of the external port application port internal protocol for IP address Enabled

  Vuze 49151 49151 times checked 192.168.1.201

  DC 4000 4000 checked two 192.168.1.201

  As you mentioned in your post that your ISP has provided you with a PPTP connection with an IP address: 192.x.x.x. The IP address that is provided by your ISP is in a private beach, and if you try to transfer all the ports on your router, it will not work, as long as your ISP modem is blocking this port. If you need get a public IP address from your ISP.

  As you get Private IP of your ISP, if this connection is called as NAT behind NAT and your Modem behaves like a router.

  So now you have 2 options, get the public IP address from your ISP or change the type of connection.