ASA 5505 redirection de port SSH DMZ

Fermé
foxinet54 Messages postés 2 Date d'inscription lundi 27 avril 2015 Statut Membre Dernière intervention 27 avril 2015 - 27 avril 2015 à 20:05
foxinet54 Messages postés 2 Date d'inscription lundi 27 avril 2015 Statut Membre Dernière intervention 27 avril 2015 - 27 avril 2015 à 20:34
Bonjour,

Je viens vers vous car je suis vraiment bloqué avec mon ASA 5505 , impossible de mettre en place du PAT pour prendre la main en SSH à mon NAS depuis l exterrieur .
Je passe à travers un freebox v6 en mode bridge .

Voici la conf de mon asa .

ASA Version 9.2(3)
!
hostname ASA
enable password 4fNWesd6YMdR2 encrypted
passwd 2KFQnbNIdIYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 10
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
switchport access vlan 30
!
interface Ethernet0/3
!
interface Ethernet0/4
switchport access vlan 20
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 2
!
interface Vlan1
nameif DMZ
security-level 50
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Vlan10
nameif outside
security-level 0
ip address dhcp setroute
!
interface Vlan30
nameif Video
security-level 80
ip address 10.0.0.1 255.0.0.0
!
boot system disk0:/asa923-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup DMZ
dns server-group DefaultDNS
name-server 212.27.40.240
name-server 212.27.40.241
object network NAS
host 192.168.1.2
description Synology
object network OwnCloud
host 192.168.1.61
object network Proxmox
host 192.168.1.50
object network honeyspot
host 192.168.1.60
object service HTTP-80
service tcp source eq www destination eq www
object service SSH-22
service tcp source eq ssh destination eq ssh
object service SSH-2222
service tcp source eq 2222 destination eq 2222
access-list outside_access_in extended permit object SSH-22 any object NAS
pager lines 24
logging enable
logging asdm notifications
mtu DMZ 1500
mtu inside 1500
mtu outside 1500
mtu Video 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-731-101.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (DMZ,outside) source dynamic any interface
nat (DMZ,outside) source static NAS NAS service SSH-22 SSH-22
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 88.163.xxx.xxx 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=ASA
keypair LOCAL-CA-SERVER
proxy-ldc-issuer
crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
certificate 87123955
30820220 30820189 a0030201 02020487 12395530 0d06092a 864886f7 0d010105
05003022 310c300a 06035504 03130341 53413112 30100609 2a864886 f70d0109
02160341 5341301e 170d3135 30343233 31353534 30335a17 0d323530 34323031
35353430 335a3022 310c300a 06035504 03130341 53413112 30100609 2a864886
f70d0109 02160341 53413081 9f300d06 092a8648 86f70d01 01010500 03818d00
30818902 81810083 c5bb4d13 e382ef6b c56783e1 1217d53f 63c5dbab 76990737
675693c7 9a0616b2 65360ca1 264331ec 4ae5fb71 7cec029f 51ddc1da 39ee4c10
094df524 4409ae59 722c8ed9 45fccd2a e2eedf0e efa6dd6d 1851f486 1f76859c
9fd0c4dc fc3b72a5 78d7e70a b69dd930 e63d238d d259063f e3e2bebf 62d76fc1
6b034fa7 27787902 03010001 a3633061 300f0603 551d1301 01ff0405 30030101
ff300e06 03551d0f 0101ff04 04030201 86301f06 03551d23 04183016 8014603f
2757dfb3 3a6ef370 6d54ae49 9de3b773 eb41301d 0603551d 0e041604 14603f27
57dfb33a 6ef3706d 54ae499d e3b773eb 41300d06 092a8648 86f70d01 01050500
03818100 138d0b56 58c9e390 a1546271 a66cb990 b6afec95 364aec2a 015ee92e
53106e21 2bf4530f 34c388eb 420fd0ee 2a2e8f94 69315231 67249fa5 d66334a6
a89bbc88 3edded44 ce1c0f38 bb5a30cb 51717088 d1fbe8cd 2eadbd12 f4ff1ba3
60e7f7d2 d94f03d0 9f4b6072 0bacd05c ee711c52 3d75c47e 9137f1dd 3442357a
8d41f86f
quit
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.0.0 255.255.255.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcp-client client-id interface outside
!
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
group-policy VPN-SSL internal
group-policy VPN-SSL attributes
vpn-tunnel-protocol ssl-clientless
webvpn
url-list value fox
username admin password f3UhLvUsXsuK7 encrypted privilege 15
username fox password M/g/lNGUrVRa encrypted privilege 0
username fox attributes
vpn-group-policy VPN
tunnel-group VPN type remote-access
tunnel-group VPN general-attributes
default-group-policy VPN
tunnel-group VPN webvpn-attributes
group-alias VPN enable
group-url https://88.163.xxx.xxx/VPN enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:eb12c7ccf82459ebd0729ec13a33
: end

Voila des que je teste un accée exterrieur en SSH , j'ai c'est log .
3 Apr 27 2015 19:46:35 37.165.xxx.xxx 31696 88.163.xxx.xxx 22 TCP access denied by ACL from 37.165.45.203/31696 to outside:88.163.xxx.xxx/22

Pourtant je pense bien avoir configurer les accées rules et les NAT rules .

Si vous avez des idées je suis preneur ,

Merci par avances
A voir également:

1 réponse

Judge_DT Messages postés 29395 Date d'inscription vendredi 5 février 2010 Statut Modérateur Dernière intervention 23 octobre 2021 9 620
27 avril 2015 à 20:30
Salut,

à priori tes ACL refusent la connexion... Que contiennent-elles? :-)
0
foxinet54 Messages postés 2 Date d'inscription lundi 27 avril 2015 Statut Membre Dernière intervention 27 avril 2015
27 avril 2015 à 20:34
Bonjour et merci ,

Je n'ai qu une ACL que j ai créé pour autoriser le port 22
access-list outside_access_in extended permit object SSH-22 any object NAS
0