Possible Duplicate:
Outside or Internet users canot reach my dmz
I did a new configuration in my ASA 5520 v7 and so bellow is the latest sh run so you can have a better idea.
My requirement are as follow:
- Internal clients need to be able to communicate with devices on the Internet.
- Internal clients need to be able to communicate with the DMZ web server.
- External clients need to be able to communicate with the DMZ web server.
- Internal network must ping the dmz web server
- DMZ web server must have internet connection
I have installed an application called Easy PHP Web site on the server on dmz running ip 172.16.16.80 eq www and from internal I can access that web site (even though they cannot ping) as I'm just simulating a normal PC as a web server because now I dont have my www running so far not even an email server. But outside users cannot reach that application webserver, and internal clients cant ping to the dmz server as well as dmz server doesn't have internet connection.
So I want to know if I'm testing it how should I simulate a user on the outside which wants to access the webserver in the dmz?
If the appliance is on production is it correct that if I have a different internet connectiosn and type in the browser http://41.223.xx.xx:80 which is eq to www and as well the :25 eq to smtp? Is this OK?
ASA Version 7.0(8)
!
hostname ciscoasa
domain-name default.domain.invalid
enable xxxxxxx encrypted
passwd xxxxxxxxx encrypted
names
dns-guard
!
interface GigabitEthernet0/0
description "Link-To-GW-Router"
nameif outside
security-level 0
ip address 41.223.xx.xx 255.255.255.248
!
interface GigabitEthernet0/1
description Link To Local Lan
nameif inside
security-level 100
ip address 10.1.4.x 255.255.252.0
!
interface GigabitEthernet0/2
description "Link-To-DMZ"
nameif dmz
security-level 50
ip address 172.16.16.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
access-list INSIDE extended permit ip 10.1.4.0 255.255.252.0 any
access-list OUT-TO-DMZ extended permit tcp any host 41.223.156.106 eq smtp
access-list OUT-TO-DMZ extended permit tcp any host 41.223.156.107 eq www
access-list OUT-TO-DMZ extended deny ip any any
access-list OUT-TO-DMZ extended permit tcp any host 41.223.156.107 eq https
access-list dmz_access_in extended permit icmp 172.16.16.0 255.255.255.0 host 172.16.16.80
access-list DMZ_IN extended permit icmp any any echo
access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any source-quench
access-list 101 extended permit icmp any any unreachable
access-list 101 extended permit icmp any any time-exceeded
access-list cap extended permit ip 172.16.16.0 255.255.255.0 10.1.4.0 255.255.252.0
access-list inside_access_in extended permit ip 10.1.x.x 255.255.252.0 any
access-list OUTSIDE extended permit tcp any host 41.223.xx.xx eq www
access-list OUTSIDE extended permit tcp any host 41.223.xx.xx eq https
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 10.1.4.x 255.255.252.0
static (dmz,outside) tcp 41.223.xx.xx www 172.16.16.80 www netmask 255.255.255.255
static (dmz,outside) tcp 41.223.xx.xx smtp 172.16.16.25 www netmask 255.255.255.255
static (inside,dmz) 10.1.x.x 10.1.x.x netmask 255.255.252.0
static (dmz,outside) 41.223.xx.xx 172.16.16.80 netmask 255.255.255.255
access-group OUTSIDE in interface outside
access-group inside_access_in in interface inside
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 41.223.xx.xx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username tchipa password JUU.kVt2Und.Vd23 encrypted privilege 15
http server enable
http 10.1.4.0 255.255.252.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
Cryptochecksum:24cefce5cd4d782e338ccbac44bc8c51
: end
username tchipa password JUU.kVt2Und.Vd23 encrypted privilege 15I mean, I know the password is salted/hashed, but come on. It's only MD5. A quick google of the hash shows that you've posting this everywhere. I'd strongly recommend changing it ASAP. – MDMarra Nov 8 '11 at 16:22