topic ASA Basic configurations in Network Security

ASA Basic configurations

tareken87 — Tue, 12 Mar 2019 04:27:42 GMT

Hi,
I have ASA 5510 8.4 with the following interfaces:
inside -------------->192.168.1.0/24 (sec-level=100)
DMZ -------------->192.168.2.0/24 (sec-level=50)
outside ------------->192.168.3.0/24 (sec-level=0)

my isp nat the public ip x.x.x.x to 192.168.3.10

in the dmz i have exchange server (192.168.2.10)

1- what is the configuration to allow both inside and dmz get access to internet

2- what is the configuration to receive emails from internet

3- how i can allow access from dmz to inside network ????

thnks

Hi , share existing show run

SANTHOSHKUMAR SARAVANAN — Sat, 12 Jul 2014 14:09:48 GMT

Hi ,

share existing show run configuration from your ASA

HTH

Sandy

If you have the IP addresses

LA-Engineer — Sat, 12 Jul 2014 18:13:48 GMT

If you have the IP addresses already configured then the first thing you'll need to do is configure a default route.

route outside 0.0.0.0 0.0.0.0 192.168.3.10

Then, you may need to nat your inside and dmz to our outside ip address.

nat (inside,outside) source dynamic any interface

nat (DZM,outside) source dynamic any interface

Then, you'll need to permit it in the interface access-llist if you have one configured:

access-list inside_access_in permit ip any any

access-list DMZ_access_in permit ip any any ! this permits DMZ to inside as well.

Then, you may need to configure inspection if you havent already.

LA-Engineer (and tareken87)

Marvin Rhoads — Sat, 12 Jul 2014 22:54:37 GMT

LA-Engineer (and tareken87):

An outside default route would point to the next hop gateway, not the interface itself.

There's no need for an access-list on the inside as it will permit any traffic to all lower security interfaces by default.

If you allow DMZ access to ip any any (including the inside) then you defeat the whole purpose of having a DMZ. One should analyze the required protocols host and ports for DMZ-Inside and allow only those in the access-list.

tarekaen87, sorry, I mistook

LA-Engineer — Sun, 13 Jul 2014 01:06:22 GMT

tarekaen87, sorry, I mistook that for the next hop. Yes, you would obviously need to set it to the next hop gateway.. not itself. The next-hop gateway will be the ISP router's IP address (192.168.3.x).

Marvin is right.. if you have one configured the traffic will need to be permitted in the ACL. If not then you don't. Some organizations like to control what traffic is allowed from one zone into another regardless of the security level. The point is, you'll need to allow the traffic if you do have an ACL configured. Otherwise, traffic will be allowed from higher security to lower security by default. So for the DMZ to Inside access, you need to just permit the traffic that you want. If you want all traffic then you will permit any. Otherwise, specify the source and destination IP/ports in your ACL entries.

I hope that helps. Let me know if any of this doesn't make sense.

Depending on all your replies

tareken87 — Sun, 13 Jul 2014 09:21:58 GMT

Depending on all your replies , I will write command as I understand and kindly correct me if I am wrong:

interface ethernet 0/1

nameif inside

security-level 100

ip address 192.168.1.254 255.255.255.0

interface ethernet 0/2

nameif dmz

security-level 50

ip address 192.168.2.2 255.255.255.0

interface ethernet 0/3

nameif outside

security-level 0

ip address 192.168.3.2 255.255.255.0

route outside 0.0.0.0 0.0.0.0 192.168.3.1

object-network pat_to_interface

subnet 0.0.0.0 0.0.0.0

nat (inside,outside) source dynamic pat_to_interface interface

object network mail_server

host 192.168.2.10

nat (dmz,outside) static 192.168.3.10

access list outside_TO_dmz extend permit tcp any host 192.168.2.10 eq 25

access- group outside_TO_dmz in interface outside

access list dmz_TO_inside extend permit tcp host 192.168.2.10 host 192.168.1.11 eq 53