topic It sounds like you need in Network Security

ASA 5506 NAT issues.

jm — Tue, 12 Mar 2019 07:21:32 GMT

Hi there...

I have recently installed a 5506 at a customer WHO has two servers that needs NAT.

One of them is a web server on a DMZ and i have enabled NAT with a public ip on src: DMZ, dest.:OUTSIDE.

Also i have made two access rules that

allows OUTSIDE to access the webserver by http/https
allows webserver to access an INSIDE server on port 587.

it works.. well allmost. The web server cannot access the internet for some reason so i tried to make an access rule that

allows webserserver to access OUTSIDE on ip

object network Applikation
host 192.168.2.2

object network Webshop
host 192.168.253.2

access-list DMZ_access_in extended permit ip object Webshop interface outside
access-list DMZ_access_in extended permit object-group DM_INLINE_SERVICE_1 object Webshop object Applikation

...

object network Webshop
nat (DMZ,outside) static <public IP>

I am new on Cisco (well its about 14 years since i had anything to do with them) so any explanations would be great.

It sounds like you need

Philip D'Ath — Fri, 19 Feb 2016 13:19:14 GMT

It sounds like you need something like:

access-list DMZ_access_in extended permit ip object Webshop any

Hi Philip and thanks.

jm — Fri, 19 Feb 2016 13:24:58 GMT

Hi Philip and thanks.

Well i have tried that but it opens op for access to all. That Means my webserver also have access to the inside Network.

So i have to make deny rules on inside to block the things i dont want in there?

Yes in that case before the

Philip D'Ath — Fri, 19 Feb 2016 13:27:41 GMT

Yes in that case before the line put in another line denying it access to the internal network.

So something like:

access-list DMZ_access_in extended permit ip object Webshop object application
access-list DMZ_access_in extended deny ip object Webshop 192.168.2.0 255.255.255.0
access-list DMZ_access_in extended permit ip object Webshop any

Thanks. That worked :)

jm — Fri, 19 Feb 2016 13:52:55 GMT

Thanks. That worked 🙂

Have a nice weekend.

Johnny