Configure Static NAT on a Cisco ASA

A common request is to enable external access to a web or mail server from the internet. The process is known as Static (one to one) NAT AKA Port Forwarding.

This solution is for Cisco ASA’s running version 8.2 or lower. If you have 8.3 or higher you can check this:

The first step is to configure your network object(s).

1. Connect to ADSM by browsing to the IP address of your Firewall under HTTPS.
Download the ASDM Launcher and login with your username and password.
3. Go to Configuration > Objects > Network Objects/Groups. Add any internal hosts which you would like to be accessed from outside the network. In this example I will forward SMTP port 25 to my internal mail server. Click Add > Network Object…
add object
Input a name, IP address, description and change the subnet mask to all 255’s. Click OK.
4. Go to Configuration > NAT Rules. Click Add > Add Static NAT Rule….

add static
In source select the network object you just created. Change the Translated Interface to Outside. In my case I have a Dynamic IP address assigned by my ISP so I have selected “Use Interface IP Address”; but if you have a static IP, input it here.

Click the checkbox “Enable Port Address Translation (PAT)” and input the desired port. Make sure you click Apply after.
nat rule
5. Go to Configuration > Access Rules. Click Add. In destination select your Network Object. In Service browse to find what you want.

access rule
If you can’t find a pre-defined service you can type TCP/3389, UDP/5061 or whatever port you require. Click OK.

Now we should be all set to go!

Normally I will use Telnet to test the configuration works as expected. This may be difficult if you don’t have an external network available to test with. I tend to use my mobile as a Wifi Hotspot and connect to it with my laptop. You can do this with the latest iPhone and Android devices.

Implement a new Front End on HAProxy

In some cases you may need to implement a new Front End in your load balancer config. For example, if you want to send traffic to a different set of backend nodes or you need to add a new SSL certificate. You will need one frontend per SSL certificate.

To create a new frontend you can duplicate an existing one and change the settings.

1.Change directory to the HAProxy root.

james@primary:~$ cd /etc/haproxy

2. Take a look at the config file to see what you need to copy

james@primary:~$ cat haproxy.cfg

3. Before making any changes take a backup of the existing config.

james@primary:~$ sudo cp haproxy.cfg haproxy{INSERT DATE HERE}.cfg 

4. Open the config file with an elevated VIM editor

james@primary:~$ sudo vim haproxy.cfg

5. Select the section which starts “frontend”. Selecting it will copy to the clipboard.

Here is an example section:

6. Copy and paste the section to the bottom of the config file by right clicking on the putty window

7. Edit the section updating any IP addresses, SSL certificates and changing the name.

Here is an example:

8. Save and quit out of Vim by typing Esc then :wq

9. Check you configuration is valid by running the following command

james@primary:~$ haproxy -f /etc/haproxy/haproxy.cfg -c


10. Next we need to add the IP Address to haresources file.

james@primary:/etc/haproxy$ sudo vim /etc/heartbeat/haresources

11. Save and quit out of Vim by typing Esc then :wq

12. Once you have updated the haresources files with the IP Address the front end should start to work. I have found it can take a short while to start working.

To speed up the process (BEWARE IN PRODUCTION ENVIRONMENTS) you can restart the Heartbeat process

james@primary:/etc/haproxy$ sudo service heartbeat restart
james@primary:/etc/haproxy$ sudo service heartbeat status


View Members of a Dynamic Distribution Group in Exchange 2013

In Exchange 2010 there used to be a handy preview button which you could press to see who is a member of a dynamic distribution group:



In Exchange 2013 I can’t find a similar feature. On the TechNet site it says you can use EAC, but this didn’t seem to work for me. Let me know if you got this to work:

So it appears the only option is a spot of PowerShell! 🙂

  1. First we need to create a Variable which will store the results of the Get-DynamicDistributionGroup command:
$TDG = Get-DynamicDistributionGroup "Test Dynamic Group"

2. Now we can use the variable together with the Get-Recipient command to return the required results:

Get-Recipient -RecipientPreviewFilter $TDG.RecipientFilter


If you specify a RecipientContainer in the Dynamic Distribution Group configuration to pick recipients from a specified OU or container in Active Directory, using the above method to return recipients will not be accurate because it returns recipients from the entire domain.

To solve this you can run:

Get-Recipient -RecipientPreviewFilter $TDG.RecipientFilter -OrganizationalUnit $TGG.RecipientContainer

Give a Security Group access to a mailbox in Exchange 2013

Having recently deployed Exchange 2013, we discovered that you can no longer give a security group access to a mailbox using the Gui (Exchange Admin Center). As you can see this Test group is not available for selection in the Exchange Admin Center:



You can select a mail-enabled security group, but a standard security group requires powershell.

1. Open Exchange Management Shell on your Exchange Server or workstation

2. Run the following command:

Add-MailboxPermission -Identity “sharedmailboxname” -User “domain\group” -AccessRights Fullaccess -InheritanceType all

You can run the following to command to verify the permissions are set:

Get-MailboxPermission -Identity “MailboxID”





Configure a GRE IPsec site to site VPN Tunnel between 2 Cisco Routers

gns3 topology2

Step 1: IKE/ISAKMP configuration

Our first task in creating an IPsec tunnel is specifying an Internet Key Exchange (IKE) policy. IKE relies on ISAKMP to establish an initial secure channel over which the IPsec tunnel can be negotiated. An IKE policy determines the attributes of the ISAKMP session, including the encryption type and hashing methods.

crypto isakmp policy 1
encryption 3des
authentication pre-share
group 2

You can run this show command to check the encryption settings of the policy:

R1#show crypto isakmp policy

Global IKE policy
Protection suite of priority 1
encryption algorithm: Three key triple DES
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 86400 seconds, no volume limit

next we define a pre-shared key. The key is a string of text used to initialize the IKE tunnel, configured identically on both routers:

crypto isakmp key B8PhgA8Aod address no-xauth

You can run this show command to verify the key association:

R1#show crypto isakmp sa


Step 2: Create GRE Tunnel

interface tunnel6
Description R1 to R2
ip address
ip virtual re-assembly
cdp enable
tunnel source
tunnel destination

We can enable CDP (Cisco Discovery Protocol) to see if the connection is made to the remote end

Configure the router at the other end with inverse settings

Step 3: IPSec configuration

Once our IKE policy has been setup we can move on to defining an IPsec transform set. The transform set defines the parameters of the IPsec security associations which will carry the actual data.

Unlike defining an IKE policy, which provides a default for all attributes, we must explicitly state the encryption and hash type we want to use with our transform set. Our example will implement ESP encapsulation with 3DES encryption and SHA-1 authentication. Within transform set configuration, we have the option to select tunnel or transport mode; tunnel mode is the default.

crypto ipsec transform-set Test esp-3des esp-sha-hmac

R1#show crypto ipsec transform-set
Transform set Test: { esp-3des esp-sha-hmac }
will negotiate = { Tunnel, },

Now that we have our IPsec transform set created, we can reference it from an IPsec profile to be applied to a tunnel interface:

crypto ipsec profile TestVPN
set transform-set Test

R1#show crypto ipsec profile


Our last step is to convert the tunnel interfaces on routers 1 and 2 to IPsec operation. First we change the tunnel mode from GRE to IPsec for IPv4, then apply our IPsec profile:

Int tunnel6
tunnel mode ipsec ipv4
tunnel protection ipsec profile TestVPN

R2#show crypto engine connections active


R1#show crypto ipsec sa

show sa

If you are having any issues you can clear the security association with this command:

clear crypto sa peer

Further diagrams and reading:

main mode

key terms

ike exchange phase 1

ike exchange phase 2