Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm configuring my Cisco ASA 5520 version 7 and below is the show run of the machine:

ASA2> en
ASA2# sh run
: Saved
: ASA Version 7.0(8)
! hostname xxxxxxxxxx
domain-name parlamento.ao
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxx encrypted
! interface GigabitEthernet0/0
description "Link-To-GW-Router"
nameif outside
security-level 0
ip address
! interface GigabitEthernet0/1
description Link To Local Lan
nameif inside
security-level 100
ip address
! interface GigabitEthernet0/2
description "Link-T
nameif dmz
security-level 50
ip address
! interface GigabitEthernet0/3
no nameif
no security-level
no ip address
! interface Management0/0
no nameif
no security-level
no ip address
! ftp mode passive
access-list OUTSIDE-IN extended permit tcp any host eq smtp 

access-list OUTSIDE-IN extended permit tcp any host eq www

access-list DMZ-IN extended deny ip any any log

access-list DMZ_IN extended permit ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 netmask

nat (inside) 1
static (dmz,outside) netmask

static (dmz,outside) netmask

access-group OUTSIDE-IN in interface outside
access-group DMZ-IN in interface dmz
route outside 1

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username tchipa password JUU.kVt2Und.Vd23 encrypted privilege 15
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
! class-map inspection_default
match default-inspection-traffic
! ! policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp inspect snmp ! service-policy global_policy global Cryptochecksum:449d5f1c3c31ec4623e58887720e339b : end

The Problem is;

At the moment, from the inside network, I can't reach or ping the DMZ. By this I mean the .1 or .25 or .80, and once the machine is running, from the inside network I can't even access the Internet as well as from Outside. I can't reach my and DMZ. But from the ASA I can ping both the pc on the inside network (, and the pc on the DMZ(

What I want:

  1. Allow my inside PCs to access the Internet.

  2. Allow outside traffic or internet users to to access my DMZ; specifically my email server and webserver

  3. Static NAT with my web and email servers

  4. Allowing inside users to access my DMZ specifically on my email server and webserver

That's basically what I need to have the machine up running.

Can anyone please give me a straight forward inputs or command to help me solve this problem please.

I thank you in advance once again... and hope my ASA sh run this time looks much more clear.

share|improve this question

1 Answer 1

First off, as GregD has recommended, you should start with upgrading to current software. There is a guide for this here.

Your commands have bled into your config printout, which makes it very hard to read. Could you please run the sh run again, and make sure that the other commands don't run while the config is still outputting? Edit your question with the new configuration (placing 4 spaces in front of each line as TiZon has done for your current one).

The packet-tracer command can help give a good idea of starting points for troubleshooting packet flow. What output do you get when you run my example from the last question (packet-tracer input inside tcp 1024 www)?

share|improve this answer
+1 for packet-tracer. –  James Sneeringer Apr 8 '11 at 16:53
OK Shane thanx alot for your comment, im out of the office n will get there in an hour time n re-do the sh run as well as the (packet-tracer input inside tcp 1024 www)? command as u asked....again many thanx indeed –  Big Denzel Apr 9 '11 at 9:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.