topic DMZ Setup unable to connect to server in Network Security

DMZ Setup unable to connect to server

bruno.machado.Mac — Sat, 25 Sep 2021 17:48:58 GMT

Hi everybody.

I´ve configured this lab and an access-list on the firewall but I can´t access the server from outside. I'm trying to figure this out but I can't seem to get it.

I´ve attached the lab in zip file if someone wants to give it a try.

Any help would be appreciated.

hostname Firewall

domain-name security.com

names

interface Ethernet0/0

switchport access vlan 3

interface Ethernet0/2

switchport access vlan 2

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address 209.165.200.226 255.255.255.248

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 70

ip address 192.168.2.1 255.255.255.0

object network dmz-server

host 192.168.2.3

object network inside-network

subnet 192.168.1.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 209.165.200.225 1

access-list OUTSIDE-DMZ extended permit icmp any host 192.168.2.3

access-list OUTSIDE-DMZ extended permit tcp any host 192.168.2.3 eq www

access-group OUTSIDE-DMZ in interface outside

object network dmz-server

nat (dmz,outside) static 209.165.200.227

object network inside-network

nat (inside,outside) dynamic interface

aaa authentication ssh console LOCAL

username bruno password z0GmywQDNOZt29FK encrypted

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 172.16.3.3 255.255.255.255 outside

ssh timeout 5

dhcpd auto_config outside

dhcpd address 192.168.1.5-192.168.1.36 inside

dhcpd dns 209.165.201.2 interface inside

dhcpd enable inside

DMZ SERVER

Deafult gw 192.168.2.1

ip add 192.168.2.3 255.255.255.0

Re: DMZ Setup unable to connect to server

Rob Ingram — Sat, 25 Sep 2021 18:09:09 GMT

@bruno.machado.Mac

Can you ping any IP address on the internet from the firewall itself?

Run a packet capture inbound on the outside interface to confirm the inbound packet even reaches the firewall.

Run packet-tracer to simulate traffic to the DMZ server and provide the output for review.

Re: DMZ Setup unable to connect to server

bruno.machado.Mac — Sun, 26 Sep 2021 15:10:09 GMT

Hi Rob.

I can ping from firewall to anywhere and from anywhere to the firewall.

Firewall#ping 172.16.3.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.3.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/13/23 ms

Firewall#ping 192.168.2.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/3/11 ms

Firewall#ping 192.168.1.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/4 ms

PC Management to Firewall

C:\>ping 209.165.200.226

Pinging 209.165.200.226 with 32 bytes of data:

Reply from 209.165.200.226: bytes=32 time=20ms TTL=252

Reply from 209.165.200.226: bytes=32 time=22ms TTL=252

Reply from 209.165.200.226: bytes=32 time=17ms TTL=252

Reply from 209.165.200.226: bytes=32 time=10ms TTL=252

Ping statistics for 209.165.200.226:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 10ms, Maximum = 22ms, Average = 17ms

DMZ-Server to own gateway

C:\>ping 192.168.2.1

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.2.1: bytes=32 time<1ms TTL=255

Reply from 192.168.2.1: bytes=32 time=5ms TTL=255

Reply from 192.168.2.1: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.2.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 5ms, Average = 1ms

PC-B to own gateway

C:\>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time<1ms TTL=255

Reply from 192.168.1.1: bytes=32 time=3ms TTL=255

Reply from 192.168.1.1: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.1.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 3ms, Average = 0ms

But when I simulate traffic from PC-Management it stops on ISP02 with the message "The routing table does not have a route to the destination IP address. The device drops the packet."...but it should be nated by the nat rule...or am I missing some configuration?

Thanks for your help.

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

D 10.1.1.0/30 [90/2681856] via 10.2.2.2, 02:54:16, Serial0/0/1

C 10.2.2.0/30 is directly connected, Serial0/0/1

L 10.2.2.1/32 is directly connected, Serial0/0/1

172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks

C 172.16.3.0/24 is directly connected, GigabitEthernet0/1

L 172.16.3.1/32 is directly connected, GigabitEthernet0/1

209.165.200.0/29 is subnetted, 1 subnets

D 209.165.200.224/29 [90/2707456] via 10.2.2.2, 01:33:04, Serial0/0/1

SSH into Firewall also works

C:\>ssh -l bruno 209.165.200.226

Password:

Firewall>

ASA CONFIG

hostname Firewall

enable password z0GmywQDNOZt29FK encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

switchport access vlan 3

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address 209.165.200.226 255.255.255.248

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 70

ip address 192.168.2.1 255.255.255.0

object network dmz-server

host 192.168.2.3

object network inside-net

subnet 192.168.1.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 209.165.200.225 1

object network dmz-server

nat (dmz,outside) static 209.165.200.227

object network inside-net

nat (inside,outside) dynamic interface

aaa authentication ssh console LOCAL

username bruno password z0GmywQDNOZt29FK encrypted

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

telnet timeout 5

ssh 172.16.3.0 255.255.255.0 outside

ssh timeout 5

dhcpd address 192.168.1.10-192.168.1.30 inside

dhcpd dns 8.8.8.8 interface inside

dhcpd enable inside

Re: DMZ Setup unable to connect to server

Rob Ingram — Sun, 26 Sep 2021 15:33:19 GMT

"But when I simulate traffic from PC-Management it stops on ISP02 with the message "The routing table does not have a route to the destination IP address. The device drops the packet."...but it should be nated by the nat rule...or am I missing some configuration?"

....but you ran a ping from PC-Management and it succeeded, how are you simulating this traffic? How about running a packet capture on the ASA inbound to determine whether the traffic even reaches the ASA. If it doesn't that indicates an issue with a device in front of the ASA, which might make sense if traffic stops on ISP02 - so therefore check ISP02.

Re: DMZ Setup unable to connect to server

bruno.machado.Mac — Tue, 28 Sep 2021 14:33:38 GMT

Hi Rob,

I figured it out. Very simple in fact.

The ASA 5505 in base license doesn´t allow for more than 3 Vlan´s, so Vlan3 interface cannot forward traffic to the inside Vlan (Vlan1) interface.

Firewall(config-if)# no forward interface vlan 1

Sometimes the answer is in front of our eyes and we don t see it 😛