NAT/PAT på ASA 5505 problem

Kan poste show run, hvis det er.

Hvis det har noget at sige, så er security level for outside 0 og indside 100.

Check din konfiguration for følgende:
static (LAN,WAN) tcp interface 3389 <SERVER-IP> 3389 netmask 255.255.255.255
access-list WAN_in extended permit tcp any interface WAN eq 3389
access-group WAN_in in interface WAN

80.62.165.PPP er public IP'en

access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit udp any host 192.168.1.5 eq 3389
access-list inside_access_in extended permit tcp any host 192.168.1.5 eq 3389
access-list inside_access_out extended permit ip any any
access-list outside_access_out extended permit ip any any
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any host 80.62.195.PPP eq 3389
access-list outside_access_in extended permit udp any host 80.62.195.PPP eq 3389
access-list outside_access_in extended permit tcp host 87.54.12.XXX eq 3389 host 80.62.195.PPP eq 3389 inactive
access-list inside_nat0_outbound extended permit ip any 192.168.1.240 255.255.255.240

nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp 80.62.165.PPP 3389 192.168.1.5 3389 netmask 255.255.255.255
static (outside,inside) 192.168.1.1 80.62.165.PPP netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group outside_access_in in interface outside
access-group outside_access_out out interface outside

glenn
Jeg vil da mene at de ting er i min conf.?

Ja. Det kræver lidt logging at finde ud af det.
Prøv til at starte med Packet Tracer'en i ASDM og se om den kan fortælle dig hvad der deny'er pakken.

Har jeg også prøvet, den viser den deny any any regel (den som er nederst).

Denne:
5        any    any    ip    Deny            [Implicit rule]
Under outside (incomming)

Du bliver ikke ramt af en access-list. Nu kan jeg ikke se hele din konfiguration, så det er svært at gennemskue hvor du har lavet fejlen.
Prøv at ændre "access-list outside_access_in extended permit tcp any host 80.62.195.PPP eq 3389" til "access-list outside_access_in extended permit tcp any interface eq 3389" og "static (inside,outside) tcp 80.62.165.PPP 3389 192.168.1.5 3389 netmask 255.255.255.255" til "static (inside,outside) tcp interface 3389 192.168.1.5 3389 netmask 255.255.255.255"

Conf ser sådan her ud:

Result of the command: "sh run"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name NAVN.dk
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 80.62.195.PPP 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
domain-name NAVN.dk
access-list outside_20_cryptomap extended permit ip any 10.10.1.0 255.255.255.0
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit udp any host 192.168.1.5 eq 3389
access-list inside_access_in extended permit tcp any host 192.168.1.5 eq 3389
access-list inside_access_out extended permit ip any any
access-list outside_access_out extended permit ip any any
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any interface inside eq 3389
access-list outside_access_in extended permit udp any host 80.62.195.PPP eq 3389
access-list outside_access_in extended permit tcp host 87.54.12.XXX eq 3389 host 80.62.195.PPP eq 3389 inactive
access-list inside_nat0_outbound extended permit ip any 192.168.1.240 255.255.255.240
access-list NAVN_VPN standard permit host 192.168.1.5
access-list NAVN_VPN standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNPool 192.168.1.242-192.168.1.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) udp 80.62.165.86 3389 192.168.1.5 3389 netmask 255.255.255.255
static (inside,outside) tcp interface 3389 192.168.1.5 3389 netmask 255.255.255.255
static (outside,inside) 192.168.1.1 80.62.195.PPP netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group outside_access_in in interface outside
access-group outside_access_out out interface outside
route outside 0.0.0.0 0.0.0.0 80.62.195.GW 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy NAVNVPN internal
group-policy NAVNVPN attributes
dns-server value 194.239.134.83 193.162.153.164
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value NAVN_VPN
default-domain value NAVN.local
split-dns none
username admin password f/IrCALPyYTeGddF encrypted privilege 0
username admin attributes
vpn-group-policy NAVNVPN
username hphp password easmZQ6J/beSPG6f encrypted privilege 0
username hphp attributes
vpn-group-policy NAVNVPN
username tmtm password h0Kf5h2P1LI3pKdQ encrypted privilege 0
username tmtm attributes
vpn-group-policy NAVNVPN
username NAVN password AgMGOKMkMdw54Bde encrypted privilege 0
username NAVN attributes
vpn-group-policy NAVNVPN
vpn-simultaneous-logins 10
username jwjw password bDMuipGL/8KTQoKM encrypted privilege 0
username jwjw attributes
vpn-group-policy NAVNVPN
username msms password ogOzXn4SeNEJjxvV encrypted privilege 0
username msms attributes
vpn-group-policy NAVNVPN
http server enable
http 83.90.203.XXX 255.255.255.255 outside
http 87.60.195.XXX 255.255.255.255 outside
http 87.54.12.XXX 255.255.255.255 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set peer 80.160.154.161
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
tunnel-group NAVNVPN type ipsec-ra
tunnel-group NAVNVPN general-attributes
address-pool (inside) VPNPool
address-pool VPNPool
default-group-policy NAVNVPN
tunnel-group NAVNVPN ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.35-192.168.1.129 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect http
  inspect icmp
  inspect ipsec-pass-thru
  inspect pptp
policy-map type inspect ipsec-pass-thru Default_IPSec_Path_Through
parameters
  esp
  ah
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:e89fec57de15c738493466b49aaf0a10
: end

Lukker pga. ferie, får tidligst kigge mere på det efter ferien.

Nu virker det pludselig :-S
Se http://ciscoforum.dk/forum/forum_posts.asp?TID=114&PN=1

Skam løs reklame: http://wiki.kimilise.dk/wiki/Cisco_ASA_5505#.C3.85bne_porte_ind_ad_.28port_forward.29 dette virker når jeg gør sådan.