topic Thanks Karsten, i have in Network Security

inside to outside ip

Anukalp S — Tue, 12 Mar 2019 04:38:14 GMT

Hi Experts..

I have users sitting on inside and they are trying to access a DMZ server with its outside(public) ip (X.X.X.191) which is static nat but they are unable to reach server. I have allowed same security permit traffic inter & intra interface. ALso have disable spoofing. Still unable to reach. Pls help me out.

object network obj-ANY
nat (inside,outside) dynamic interface

object network obj-ftp-server
nat (dmz,outside) static X.X.X.191

Have you permitted traffic

Marvin Rhoads — Thu, 14 Aug 2014 14:06:29 GMT

Have you permitted traffic same-security intra-interface?

If so, and it's still not working, please run:

packet-tracer input inside tcp [user ip address] 1025 x.x.x.191 [server port]

...and share the output

This problem has to be solved

Karsten Iwen — Thu, 14 Aug 2014 14:11:13 GMT

This problem has to be solved by manipulating DNS in a way that the internal users resolve the DMZ-server to the real address instead of the translated address. The users have to access the server by FQDN and not by IP-address.

There are two common ways to get that working:

DNS-Doctoring on the ASA.
For that you just add the keyword "dns" to your nat-statement:
object network obj-ftp-server nat (dmz,outside) static X.X.X.191 dns
Add the FQDN of the server to your internal DNS.

Hi.. Currently i am trying

Anukalp S — Thu, 14 Aug 2014 14:40:47 GMT

Hi.. Currently i am trying to ping this server outside ip to check reachability, here is logs.

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in X.X.X.0 255.255.255.0 outside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group IN in interface inside
access-list IN extended permit icmp any4 any4
access-list IN remark Allow Domain for Entire Network
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
object network obj_any
nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 192.168.110.38/0 to X.X.X.5/18216

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 8
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type:
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:

Phase: 14
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 160797423, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

Hi.. Currently i am trying

Anukalp S — Thu, 14 Aug 2014 14:42:11 GMT