topic Adding New Public IP Block in Network Security

Adding New Public IP Block

DarrenMcCall — Tue, 12 Mar 2019 00:17:43 GMT

My web server is out of public IPs. I requested more from my ISP and I got a different range with a different gateway. How do I handle the configuration on my Cisco ASA?

Without any configuration changes to the firewall I saw the traffic hitting it and being blocked. I added an access rule to allow the traffic. I added a virtual interface on the ASA. I added a virtual interface on the web server. Using "Packet Tracer" the traffic flows from the outside interface to the new virtual interface. But I'm unable to access my web server and I don't see any traffic on that IP reaching the web server.

Using Cisco ASA 5510.

Please ask any questions and I will add more information as needed.

Adding New Public IP Block

Julio Carvajal — Thu, 01 Nov 2012 19:08:52 GMT

Hello Darren,

What version are you running,

What is the private ip of the server ( use a fake if required), then share the relevant configuration ( Nat, interface and ACL's using the fake Ips as mentioned before)

Regards

Re: Adding New Public IP Block

DarrenMcCall — Thu, 01 Nov 2012 19:26:59 GMT

ASDM 6.2.

Here are my options for NAT Rules:

I added the dmz.3 interface.

Private IP is set as a virtual interface to the same as the public IP. This is the way our other existing, and working, block is configured.

Here are the Access Rules I setup to allow the traffic.

dmz-network is our original block that is working.

dmz.3-network is the new block that doesn't work.

Here are the interfaces:

Adding New Public IP Block

Julio Carvajal — Thu, 01 Nov 2012 19:30:40 GMT

Hello Darren,

I need the ASA version!

Adding New Public IP Block

Julio Carvajal — Thu, 01 Nov 2012 19:31:07 GMT

Can you do

show run nat

show run access-list

That will make it easier for us

Re: Adding New Public IP Block

DarrenMcCall — Thu, 01 Nov 2012 19:31:48 GMT

ASA version was in the original post: ASA 5510.

Adding New Public IP Block

DarrenMcCall — Thu, 01 Nov 2012 19:33:16 GMT

Result of the command: "show run nat"

nat (inside) 0 access-list inside_nat0_outbound

nat (dmz) 0 access-list dmz_nat0_outbound

Adding New Public IP Block

DarrenMcCall — Thu, 01 Nov 2012 19:34:45 GMT

Unfortuantly I can't copy and paste the show run access-list there is so much there. I will try to clean it up and post soon.

But the traffic is allowed in the Access List for "dmz3", just like "dmz".

dmz is working, dmz3 is not.

Adding New Public IP Block

Julio Carvajal — Thu, 01 Nov 2012 19:35:47 GMT

Hello Darren,

Please check your inbox