Access-list help???

robbo79871 — Tue, 12 Mar 2019 07:06:22 GMT

Hi, I'm trying to get my clients from another site access to the secure web server in my interior network. Below are the object groups and access lists i have configured on the ASA where the web server is attached to.

object network asa_inside_address

subnet 10.30.0.1 255.255.255.255

object network inside_network

subnet 10.30.0.0 255.255.255.0

access-list website_outside extended permit tcp any object asa_inside_address eq 443

access-list website_outside extended permit icmp any object asa_inside_address

access-list website_outside extended permit icmp any object inside_network

access-group website_outside in interface outside

When i apply the access list i cant ping from the outside network and i cant even ping from the router on the outside network to the ASA outside address of 172.16.30.2 but when i remove the access group it allows me to ping again from the router and from the outside PC but doesn't let me ping the inside interfaces which is what i was trying to do in the first place.

Can anyone help me on this and why it wont even let me ping the OUTSIDE interface on the ASA when the access group is on? And how can I poke a hole in the firewall to make the connection to the secure web server which has an address of 10.30.0.10?

Also, one more thing, when i try to create an access list on the other ASA where the PC's are pinging on. I try and create this but it comes back with a strange error

ASA1(config)#access-list allow_webserver extended permit tcp 10.30.0.0 0.0.0.255 eq 443 10.20.0.0 0.0.0.255
ERROR: IP address,mask <10.30.0.0,0.0.0.255> doesn't pair

I'm trying to match the traffic flow on the ASA because in packet tracer it doesnt let you inspect HTTPS on the global service policy i have created here on both:

class-map inspect

match default-inspection-traffic

policy-map global

class inspect

inspect icmp

service-policy global global

Routers use wldcard masks.

Philip D'Ath — Wed, 06 Jan 2016 09:43:05 GMT

Routers use wldcard masks.

ASA1(config)#access-list allow_webserver extended permit tcp 10.30.0.0 0.0.0.255 eq 443 10.20.0.0 0.0.0.255
ERROR: IP address,mask <10.30.0.0,0.0.0.255> doesn't pair

ASA's use normal subnets, so use:

ASA1(config)#access-list allow_webserver extended permit tcp 10.30.0.0 255.255.255.0 eq 443 10.20.0.0 255.255.255.0

topic Access-list help??? in Network Security

Access-list help???

Routers use wldcard masks.