On Mon, Jul 11, 2011 at 3:16 PM, <bill@kruchas.com> wrote:

  connection. ip address outside-ip 255.255.255.252 Aside from the fact 255.255.255.252 is not a valid IP address.

Firewalls are security sensitive devices, I suggest reading docs and not relying on untrusted sources for basic operating directions; if improperly configured a Firewall may pass traffic but be insecure. I can't tell you exactly what buttons to hit in the SDM right now, but I see you have " access-list Etherpoint_access_in extended permit tcp any eq 3389 host 192.168.125.8 eq 3389" Unless "192.168.125.8" is your global IP, something is wrong here. You should permit to destination port 3389 on the global IP, on the inbound ACL of your outside interface, when you are applying an ACL before translation. Then traffic matching your port forwarding rule would then be allowed through that ACL " access-list Etherpoint_access_in extended permit tcp host 192.168.125.8 eq 3389 any eq 3389" You don't need this, assuming .125.8 is an inside IP and Etherpoint is your outside int.

  Here is the pertinent section of the runing config.

  !   interface Ethernet0/2    nameif Etherpoint    security-level 0    ip address outside-ip 255.255.255.252    ospf cost 10   !

  object-group service terminal-services tcp    port-object eq 3389   access-list Inside_access_in extended permit icmp any any   access-list Inside_access_in extended permit ip 192.168.125.0   255.255.255.0 any   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 MobileVPN 255.255.255.0   access-list Inside_nat0_outbound extended permit ip 192.168.0.0   255.255.255.0 MobileVPN 255.255.255.0 inactive   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 any inactive   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 192.168.1.0 255.255.255.0   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 192.168.14.0 255.255.255.0   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 192.168.100.0 255.255.255.0   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 192.168.101.0 255.255.255.0   access-list Inside_nat0_outbound extended permit ip 192.168.125.0   255.255.255.0 192.168.253.0 255.255.255.0   access-list Haven_splitTunnelAcl_1 standard permit 192.168.125.0   255.255.255.0   access-list Etherpoint_access_in extended permit tcp host 192.168.125.8   eq 3389 any eq 3389   access-list Etherpoint_access_in extended permit tcp any eq 3389 host   192.168.125.8 eq 3389   access-list Etherpoint_access_in extended permit tcp any host   192.168.125.8 eq 3389   access-list Etherpoint_nat0_outbound extended permit ip host   192.168.125.8 host outside-ip   access-list Etherpoint_nat0_outbound extended permit ip host outside-ip   host 192.168.125.8

  ip local pool HavenVPN 192.168.253.1-192.168.253.254 mask 255.255.255.0

  global (Etherpoint) 2 interface

  nat (Inside) 0 access-list Inside_nat0_outbound   nat (Inside) 2 192.168.125.0 255.255.255.0   nat (Etherpoint) 0 access-list Etherpoint_nat0_outbound outside   static (Inside,Etherpoint) tcp interface 3389 192.168.125.8 3389   netmask 255.255.255.255

  no threat-detection statistics tcp-intercept   access-group Inside_access_in in interface Inside   access-group Etherpoint_access_in in interface Etherpoint

  route Etherpoint 0.0.0.0 0.0.0.0 204.186.102.187 1

  -------- Original Message --------   Subject: Re: Hello List, a easy Cisco question.   From: Dennis <[1]daodennis@gmail.com>   Date: Mon, July 11, 2011 12:39 pm   To: [2]bill@kruchas.com   On Mon, Jul 11, 2011 at 12:33 PM, <[3]bill@kruchas.com> wrote:   >   Hello,   >   >       I am not a heads down network guy, but I have setup a few   >   firewalls, and have got them to do what I wanted, "eventually". But   >   mostly through reading and trial and error.   >   >       I am struggling with this one, but I think I know the answer,   but   >   want to verify it with some experts.   >   >   >   >       We have a cisco asa 5505, with an internet connection with only   one   >   useable ip address (subnet 255.255.255.252). We/they have had a nat   >   setup for outgoing connections for some time, but I have been   trying to   So your provider has your ASA behind a NAT or there is a NAT   inside,outside statement on your ASA?   Some more pieces of the configuration would be helpful here too.   Thanks,   Dennis O.

References

  1. mailto:daodennis@gmail.com   2. mailto:bill@kruchas.com   3. mailto:bill@kruchas.com

Regards, -- -JH