topic Hi , Thanks for the reply. in Network Security

DMZ Zone

saroj pradhan — Tue, 12 Mar 2019 03:56:08 GMT

Hi ,

i have created a DMZ Zone on the cisco ASA 5510 Firewall. The DMZ is using public IP Address .

able to access internet from the DMZ Zone. But unable to access the server from inside to the dmz zone.

please suggest command to allow access of the inside network to the dmz network,

Regards,

Saroj

Also please suggest allow from internet access the dmz server.

Regards,

Saroj

If you have an ACL on the

Karsten Iwen — Thu, 13 Mar 2014 07:12:15 GMT

If you have an ACL on the inside interface, then you need an ACE for the traffic.
The traffic from inside to the DMZ has to be exempted from NAT. The config-syntax depends on the version of the ASA, but you don't tell us which version you are running.

For ASA up to 8.2:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/nat_bypassing.html#wp1077621

For ASA 8.3+:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_rules.html#wp1232160

Hi ,

saroj pradhan — Thu, 13 Mar 2014 10:39:24 GMT

Hi , as i am using Public ip address of the server in the DMZ Zone. please suggest command to allow from internet the access of server. Regards, Saroj

The following ACL allows any

Karsten Iwen — Thu, 13 Mar 2014 12:33:30 GMT

The following ACL allows any HTTP- and HTTPS-traffic to your DMZ-server (192.0.2.80 in my example):

access-list OUTSIDE-IN permit tcp any host 192.0.2.80 eq 80

access-list OUTSIDE-IN permit tcp any host 192.0.2.80 eq 443

That ACL needs to be applied to the outside interface:

access-group OUTSIDE-IN in interface outside

If there is already an ACL on the outside interface, that use that ACL instead.

Hi , Thanks for the reply.

saroj pradhan — Tue, 18 Mar 2014 07:11:00 GMT

Hi ,

Thanks for the reply. The DMZ server is accessable from internet. But still the server unable to access from Inside interface. Encloesd please find my ASA config and help .

Does it need any routing also.?

Regards,

Saroj

Hi, now i have configured

saroj pradhan — Tue, 18 Mar 2014 10:27:41 GMT

Hi,

now i have configured the nat exampt and able to ping the DMZ Server from Inside of the ASA Fireawll but unable to access the Server on port 80.

please advice.

Regards,

Saroj

Hi ,i am trying to access

saroj pradhan — Tue, 18 Mar 2014 10:56:45 GMT

Hi ,

i am trying to access the web server 122.168.191.226 from my PC 172.16.48.111 on port but unable to access .i run a command packet-tracer input inside tcp 172.16.48.111 12345 122.168.191.226 80 .Encloesd the report and please advice.

Regards,

Saroj