Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hi everyone out there.

I have configured my aa 5520 v7. and so far im facing a problem in my connection and therefore i wish someone here can help me to sort it out.

  1. wright now Internal network can access the internet

whats not working now and that i would like to be helped now is:

  1. Inside zone doesnot communicate to dmz and not even by ping

  2. Outside or internet user cannot reach my dmz to its server with ip (172.16.16.80 eq www and 172.16.16.25 eq smtp)

4: no Internet on the dmz zone.

So bellow is my sh run so you can have a better understanding of my config.

so can anyone try to have a closer look at my sh run config and try to figure out why can´t my internal users access my dmz even by pinging? And why can´t outside or internet users cant reach my dmz? And why i dont have internet on dmz? And how do i allow successfull ping to dmz from the inside zone?

ciscoasa(config)# sh run
: Saved
:
ASA Version 7.0(8)
!
hostname ciscoasa
domain-name xxxxxxxxxxx
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxx encrypted
names
dns-guard
!
interface GigabitEthernet0/0
description Link to Gateway
nameif outside
security-level 0
ip address 41.223.xx.xx 255.255.255.255
!
interface GigabitEthernet0/1
description Link to Local Lan
nameif inside
security-level 100
ip address 10.1.4.1 255.255.252.0
!
interface GigabitEthernet0/2
description Link to dmz
nameif dmz
security-level 50
ip address 172.16.16.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
access-list outside_in extended permit tcp any host 41.223.xx.xx eq smtp
access-list outside_in extended permit tcp any host 41.223.xx.xx eq www
access-list dmz_int extended permit tcp host 172.16.16.25 any eq smtp
access-list dmz_int extended permit tcp host 172.16.16.80 any eq www
access-list outside_int extended permit tcp any host 41.223.xx.xx eq smtp
access-list outside_int extended permit icmp any any
access-list INSIDE extended permit ip 10.1.4.0 255.255.252.0 any
access-list OUT-TO-DMZ extended permit icmp any any log
access-list OUT-TO-DMZ extended deny ip any any
access-list inside extended permit tcp any any eq pop3
access-list inside extended permit tcp any any eq smtp
access-list inside extended permit tcp any any eq ssh
access-list inside extended permit tcp any any eq https
access-list inside extended permit udp any any eq domain
access-list inside extended permit tcp any any eq domain
access-list inside extended permit tcp any any eq www
access-list inside extended permit ip any any
access-list inside extended permit icmp any any
access-list dmz extended permit ip any any
access-list dmz extended permit icmp any any
access-list DMZ_IN extended permit icmp any any echo
access-list 101 extended permit icmp any any echo-reply
access-list cap extended permit ip 172.16.16.0 255.255.255.0 10.1.4.0 255.255.252.0
access-list cap extended permit ip 10.1.4.0 255.255.252.0 172.16.16.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 10.1.4.0 255.255.252.0
static (inside,dmz) 10.1.4.0 10.1.4.0 netmask 255.255.252.0
static (dmz,outside) 41.223.xx.xx 172.16.16.25 netmask 255.255.255.255
static (dmz,outside) 41.223.xx.xx 172.16.16.80 netmask 255.255.255.255
access-group dmz_int in interface dmz
access-group inside in interface inside

route outside 0.0.0.0 0.0.0.0 41.223.xx.xx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username tchipa password JUU.kVt2Und.Vd23 encrypted privilege 15
aaa authentication ssh console LOCAL
http server enable
http 10.1.4.x 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 10.1.4.x 255.255.255.255 inside
ssh timeout 10
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
Cryptochecksum:48ba8cf4e31f2940e44293256d84ce38
: end

I would really appratiate any help from you as im kind of desparated and in the mean time i thank everone in advance for your time and cooperatin.

BD

share|improve this question
    
I've edited out your passwords - you should never post passwords publicly, regardless of whether they are encrypted / hashed etc. I suggest you change them immediately. You may also want to remove your public IP's. –  Dan Nov 1 '11 at 12:36
    
more to the point, having both your passwords and public IP's of your external firewall posted on a public site is a VERY BAD IDEA –  Rex Nov 1 '11 at 14:22

1 Answer 1

static (dmz,outside) 41.223.156.106 172.16.16.25 netmask 255.255.255.255  
static (dmz,outside) 41.223.156.107 172.16.16.80 netmask 255.255.255.255

This is very, very bad - you never NAT traffic from a LOW security interface to a HIGHER security interface.
You should do that the other way around:

static (outside,dmz) 172.16.16.25 41.223.156.106 netmask 255.255.255.255
static (outside,dmz) 172.16.16.80 41.223.156.107 netmask 255.255.255.255

Apart from that, none of your ACLs are applied to anything, except the dmz_int and inside ones.

share|improve this answer
    
Hi dear adapttr. thanx alot for you reply and for your advice as well. i really appretiate alot. By the way you mean i should configure this: # static (outside,dmz) 172.16.16.25 41.223.156.106 netmask 255.255.255.255 static (outside,dmz) 172.16.16.80 41.223.156.107 netmask 255.255.255.255 –  Big Denzel Nov 1 '11 at 15:12
    
Hi dear adapttr. thanx alot for you reply and for your advice as well. i really appretiate alot. By the way you mean i should configure this: # static (outside,dmz) 172.16.16.25 41.223.156.106 netmask 255.255.255.255 static (outside,dmz) 172.16.16.80 41.223.156.107 netmask 255.255.255.255 ??? so is basically this line that i need for the solution im look for? will that make my internal network to reach my dmz? will internet or outside users reach my dmz? will i get successfull pings to the dmz from the inside zone?? BD –  Big Denzel Nov 1 '11 at 15:27
    
HI Den and Rex... thanx alot for your advices, i got it and will never do that again... thank you BD –  Big Denzel Nov 1 '11 at 15:36
    
Dear Adaptr..i do really appratiate ur feedback..however could you pls be more specified to your reppy pls.. do you mean i should remove the first static i have applied(the one you put above) and configure the one you put under...I mean u mean to remove this: #static (dmz,outside) 41.223.156.106 172.16.16.25 netmask 255.255.255.255 static (dmz,outside) 41.223.156.107 172.16.16.80 netmask 255.255.255.255 and configure or change with this: #static (outside,dmz) 172.16.16.25 41.223.156.106 netmask 255.255.255.255 static (outside,dmz) 172.16.16.80 41.223.156.107 netmask 255.255.255.255 BD –  Big Denzel Nov 1 '11 at 15:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.