topic If you can reach other in Network Security

Simple question - How to configure a rule in ASA 5525

weichenberger1 — Tue, 12 Mar 2019 05:26:30 GMT

I am a newbie to ASA configuration and need some assistance with configuring a rule to allow access to a particular site from inside our network.

We have an ASA 5525 cluster and I need a configuration that will allow our internal network 10.26.0.0/16 to an external site 198.38.xx.xx/32. Can anyone give me some pointers on how to configure this?

Issue the command "show run

Karsten Iwen — Tue, 03 Feb 2015 15:14:05 GMT

Issue the command "show run access-group" and look for the name of the access-list that is bound to your inside interface.

In that access-list you need an entry like the following:

access-list NAME permit ip 10.26.0.0 255.255.0.0 host 198.38.x.x

It could be improved by configuring or using objects for you internal network and the server:

object NAME-OF-YOUR-INTERNAL-NET
 subnet 10.26.0.0 255.255.0.0
object network NAME-OF-THE-SERVER
 host 198.38.xx.xx
!
access-list NAME permit ip object NAME-OF-YOUR-INTERNAL-NET object NAME-OF-THE-SERVER

Here is the output. Which

weichenberger1 — Tue, 03 Feb 2015 15:19:41 GMT

Here is the output. Which access-list that is bound to my inside interface?

Firewall# show run access-group | in inside
access-group Inside_access_in in interface inside
access-group Inside_access_out out interface inside

Also, what are NATing? Do I

weichenberger1 — Tue, 03 Feb 2015 15:21:46 GMT

Also, what are NATing? Do I need any?

If you can reach other

Karsten Iwen — Tue, 03 Feb 2015 15:28:42 GMT

If you can reach other systems on the internet, it's very likely that you don't need any additional NAT.

The name of the access-list is "Inside_access_in". That needs the new line.

I configured the following

weichenberger1 — Tue, 03 Feb 2015 15:39:59 GMT

I configured the following and still unable to access the site from inside our network. Also, I am unable to ping it.

access-list Inside_access_out permit ip object obj-10.26.0.0-02 object obj-reportssite

object network obj-10.26.0.0-02

subnet 10.26.0.0 255.255.0.0

access-list Inside_access_out extended permit ip object obj-10.26.0.0-02 object obj-reportssite

host 198.38.82.23

It's "inside_access_in", not

Karsten Iwen — Tue, 03 Feb 2015 15:46:30 GMT

It's "inside_access_in", not "inside_access_out".

Config as below and still

weichenberger1 — Tue, 03 Feb 2015 15:59:27 GMT

Config as below and still unable to ping or http to external IP address.

object network obj-10.26.0.0-02

subnet 10.26.0.0 255.255.0.0

object network obj-reports

host 198.38.xx.xx

access-list Inside_access_in extended permit ip object obj-10.26.0.0-02 object obj-reports

please post your config

Karsten Iwen — Tue, 03 Feb 2015 16:02:22 GMT

please post your config (without passwords) to see what's going wrong.