topic Re: Routing DMZ <-> INSIDE in Network Security

Routing DMZ <-> INSIDE

Stephan-Wild — Tue, 12 Mar 2019 00:47:55 GMT

Hey together,

I have a little problem creating a network infrastucture with an "inside", "dmz" and an "outside" network on my ASA5512-x 8.6(1).

I have have clients and servers with the networks 10.0.1.0/24, 10.0.2.0/24 until 10.0.12.0/24 on my inside interface. Then I have two servers 10.0.254.50/24 for SMTP and 10.0.254.70/24 for HTTPS in my dmz network. The outside interface is one static IP to the Internet.

I configured the interfaces with the security-levels 0 (outside), 50 (dmz) and 100 (inside).

There are object-groups for the inside networks, an object for inside_mail_server,dmz_mail_server and the same for the webservers and objects for the PAT services.

The nat configuration at the time is very simple (the nat exemption for l2l vpn and RA vpn are not in the following listing). I do a forwarding from outside to dmz

nat (outside,dmz) source static any any destination static interface dmz_web_server service pat_https pat_https

nat (outside,dmz) source static any any destination static interface dmz_mail_server service pat_smtp pat_smtp

nat (inside,outside) source dynamic inside_net interface

nat (dmz,outside) source dynamic dmz_net interface

The access list for the forwarding is:

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any eq smtp

access-group outside_access_in in interface outside

This works very fine but now I want to allow access from the dmz-servers to inside-servers. I tried an access-list "permit tcp host dmz_web_server host inside_web_server eq https" and I bound it to "in interface dmz"

I cannot access the dmz servers from my inside network and from dmz to inside.

If it is possible, I don't want to use translation between inside and dmz.

Thanks a lot

Stephan

Re: Routing DMZ <-> INSIDE

Jouni Forss — Wed, 16 Jan 2013 14:07:50 GMT

Hi,

By default the newer softwares dont require any NAT configurations from you for the traffic between your own private networks if you dont specifically need/want a NAT for the traffic.

I would personally suggest a different NAT to accomplish the above mentioned configuration

I'll give examples below

Configuration Static PAT / Port Forwarding

object network DMZ-HTTPS

host 10.10.20.10

nat (dmz,outside) static interface service tcp 443 443

object network DMZ-SMTP

host 10.10.20.20

nat (dmz,outside) static interface service tcp 25 25

Where

10.10.20.10 and 10.10.20.20 = Example IP addresses
"dmz" and "outside" = example interface names

Default PAT for both LAN and DMZ

object-group DEFAULT-PAT-SOURCE

network-object 10.10.10.0 255.255.255.0

network-object 10.10.20.0 255.255.255.0

nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

nat (dmz,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

Where

DEFAULT-PAT-SOURCE = Defines the source addresses for the PAT translations
"after-auto" = Moves the Default PAT rules to the Section 3 of the ASAs NAT rules
- They will be matched the last if no other Section 1 and Section 2 rule match them
- Section 1 = Twice NAT and Section 2 = Object NAT

There is a slight chance that the NAT0 type configuration might be also messing with the LAN - DMZ traffic.

Generally I would avoid using "any" either as defining the "source"/"destination" address or the interfaces in the NAT configurations. They can cause problems with traffic passing through the ASA because they can match traffic they arent supposed to.

Please rate if the information was helpfull and/or ask more questions if needed

- Jouni

Re: Routing DMZ <-> INSIDE

Stephan-Wild — Wed, 16 Jan 2013 15:37:50 GMT

Hi Jouni,

I reconfigured my test ASA with the following:

: Saved

: Written by enable_15 at 15:04:40.849 UTC Wed Jan 16 2013

ASA Version 8.6(1)

hostname ciscoasa

names

interface Ethernet0/0

nameif outside

security-level 0

ip address 1.1.1.170 255.255.255.248

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

interface Ethernet0/2

nameif dmz

security-level 50

ip address 10.0.254.1 255.255.255.0

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

shutdown

no nameif

no security-level

no ip address

ftp mode passive

object network DMZ-HTTPS

host 10.0.254.70

object network DMZ-SMTP

host 10.0.254.50

object-group network INSIDE_NETWORKS

network-object 10.0.1.0 255.255.255.0

network-object 10.0.2.0 255.255.255.0

network-object 10.0.3.0 255.255.255.0

network-object 10.0.4.0 255.255.255.0

network-object 10.0.5.0 255.255.255.0

object-group network DMZ_NETWORKS

network-object 10.0.254.0 255.255.255.0

object-group network DEFAULT_PAT_SOURCE

group-object INSIDE_NETWORKS

group-object DMZ_NETWORKS

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any eq smtp

access-list outside_access_in extended permit tcp any any eq www

access-list dmz_inside extended permit tcp host 10.0.254.50 host 10.0.1.50 eq smtp

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq www

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq https

access-list dmz_inside extended permit ip object-group INSIDE_NETWORKS object-group DMZ_NETWORKS

icmp permit any outside

icmp permit any inside

icmp permit any dmz

object network DMZ-HTTPS

nat (dmz,outside) static interface service tcp www www

object network DMZ-SMTP

nat (dmz,outside) static interface service tcp smtp smtp

nat (inside,outside) after-auto source dynamic DEFAULT_PAT_SOURCE interface

nat (dmz,outside) after-auto source dynamic DEFAULT_PAT_SOURCE interface

access-group outside_access_in in interface outside

access-group dmz_inside in interface dmz

route outside 0.0.0.0 0.0.0.0 1.1.1.169 1

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

I changed the https to www for testing. I can access from inside, dmz to outside from outside to dmz from inside to dmz but not from dmz to inside. What is my fault?

Stephan

Re: Routing DMZ <-> INSIDE

Jouni Forss — Wed, 16 Jan 2013 15:46:13 GMT

Hi,

The configuration seems fine to me for the most part.

What I did notice that you have configured your INSIDE networks as the source and DMZ as the destination in your "dmz" ACL. I presume you were meaning to configure it the other way around?

Maybe the traffic is getting blocked by the ACL still?

You can try the following command to confirm what the ASA does to your traffic (even though I can see your configuration but I cant be sure on the source and destination IP address you are using for tests)

packet-tracer input dmz tcp

Use the command with the correct IPs and Ports you want and copy/paste the output from CLI to here

- Jouni

Re: Routing DMZ <-> INSIDE

Stephan-Wild — Wed, 16 Jan 2013 15:56:58 GMT

Hi,

I thought i have to add the last line of the dmz_inside acl to allow the reverse traffic from inside ip addresses to dmz addresses.

Here is the output of the packet-tracer:

ciscoasa# packet-tracer input dmz tcp 10.0.254.70 55555 10.0.1.70 80

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

MAC Access list

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.0.1.0 255.255.255.0 inside

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group dmz_inside in interface dmz

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq www

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 1, packet dispatched to next module

Result:

input-interface: dmz

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

It seems to be fine but I cannot open a website from 10.0.254.70 on 10.0.1.70.

Stephan

Routing DMZ <-> INSIDE

Jouni Forss — Wed, 16 Jan 2013 16:13:39 GMT

Hi,

Everything seems to be fine regarding the firewall on the basis of that output atleast.

Have you check the firewall logs through ASDM or the CLI when you are attempting the actual HTTP connection between the 2 hosts?

The logging level would need to be atleast "informational"

logging asdm informational

logging buffered informational

And you would be looking for log messages starting with "Built outbound/inbound TCP connection" and "Teardown TCP connection"

If the Teardown message reason is SYN Timeout the inside host is not responding to the connection forming attempt.

- Jouni

Routing DMZ <-> INSIDE

Stephan-Wild — Wed, 16 Jan 2013 16:31:07 GMT

Hi Jouni,

I'm so sorry. After a long time configuring a firewall and servers...

I had an error in my inside webserver ip address. Everything is working fine.

Thank you very very much.

Sorry again for my mistake.

Routing DMZ <-> INSIDE

Jouni Forss — Wed, 16 Jan 2013 16:32:33 GMT

Hi,

No problem Stephan. Main thing is that its working now

- Jouni