topic Re: Pinging DMZ Server from outside without applying Access list in Network Security

Pinging DMZ Server from outside without applying Access list to DMZ Interf.

aamirkiani — Mon, 11 Mar 2019 15:56:40 GMT

************************

Kindly look on the configuration and guide me please.

************************

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 10.10.10.2 255.255.255.252

interface GigabitEthernet0/1

nameif Inside

security-level 100

ip address 192.168.0.1 255.255.255.0

interface GigabitEthernet0/2

nameif DMZ

security-level 50

ip address 192.168.100.1 255.255.255.0

interface GigabitEthernet0/3

description LAN Failover Interface

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot system disk0:/asa804-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

access-list outside_access_in extended permit tcp 192.168.22.0 255.255.255.0 host 192.168.0.210 eq ftp

access-list outside_access_in extended permit tcp 192.168.22.0 255.255.255.0 host 192.168.0.201 eq www

access-list outside_access_in extended permit tcp 192.168.22.0 255.255.255.0 host 192.168.0.204 eq www

access-list outside_access_in extended permit ip 192.168.255.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list outside_access_in extended permit icmp 10.10.10.0 255.255.255.252 192.168.0.0 255.255.255.0

access-list outside_access_in extended permit tcp host 192.168.22.38 host 192.168.0.201 eq 8080

access-list outside_access_in extended permit tcp 192.168.22.0 255.255.255.0 host 192.168.0.201 eq 7777

access-list outside_access_in extended deny tcp host 192.168.22.38 host 192.168.0.201 eq 7777

access-list outside_access_in extended permit tcp host 192.168.22.100 host 192.168.0.201 eq 8080

access-list outside_access_in extended permit icmp 192.168.22.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list outside_access_in extended permit tcp host 192.168.22.100 host 192.168.0.204 eq 8080

access-list outside_access_in extended permit tcp host 192.168.22.100 host 192.168.0.204 eq 7777

access-list outside_access_in extended permit ip 192.168.255.0 255.255.255.0 192.168.100.0 255.255.255.0

access-list outside_access_in extended permit icmp 10.10.10.0 255.255.255.252 192.168.100.0 255.255.255.0

access-list nonat extended permit ip 192.168.0.0 255.255.255.0 any

access-list DMZ_access_in extended permit ip host 192.168.100.0 192.168.0.0 255.255.255.0

access-list DMZ_access_in extended permit ip 192.168.255.0 255.255.255.0 192.168.100.0 255.255.255.0

access-list nonatDMZ extended permit ip 192.168.100.0 255.255.255.0 any

access-list traffic_for_ips extended permit ip any any

pager lines 24

logging asdm informational

mtu outside 1500

mtu Inside 1500

mtu DMZ 1500

mtu management 1500

ip verify reverse-path interface outside

ip verify reverse-path interface Inside

failover

failover lan unit primary

failover lan interface failovetr-int GigabitEthernet0/3

failover replication http

failover interface ip failovetr-int 10.250.250.1 255.255.255.252 standby 10.250.250.2

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-61551.bin

asdm history enable

arp timeout 14400

nat (Inside) 0 access-list nonat

nat (DMZ) 0 access-list nonatDMZ

static (Inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 10.10.10.1 1

Re: Pinging DMZ Server from outside without applying Access list

Kureli Sankar — Sun, 19 Jul 2009 12:07:06 GMT

Pls. provide the output of "sh run policy-map" make sure there inspect icmp is enabled.

example:

policy-map global_policy

class inspection_default

inspect ftp

inspect icmp

service-policy global_policy global

Re: Pinging DMZ Server from outside without applying Access list

aamirkiani — Sun, 19 Jul 2009 12:26:20 GMT

**********************

Kindly look at my configuration and guide me how i can solve my problem,

1.Im able to ping 192.168.100.215 server in DMZ from outside source ip 192.168.255.1 how? it is possible without apply access list to DMZ interface.2. when im applying access list to DMZ inerface then from outside im not able to ping DMZ server 192.168.100.215.why?

3. I want to access to DMZ network from Inside network. if any thing wrong pleae guide me.my complete ASA configuration as following.

******************************************* ASA Version 8.0(4)