topic Re: ASA 5505 DMZ configuration in Network Security

ASA 5505 DMZ configuration

czone51334 — Mon, 11 Mar 2019 13:12:51 GMT

Having trouble configuring web server in DMZ on ASA 5505 w/ security plus. Can access internal server from web server ok and can vnc to web server but web server can't access internet and internet users can't access web server.

Re: ASA 5505 DMZ configuration

a.alekseev — Fri, 11 Jul 2008 15:45:48 GMT

show the configuration...

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 16:27:08 GMT

Here is the running config.

Re: ASA 5505 DMZ configuration

a.alekseev — Fri, 11 Jul 2008 16:47:21 GMT

access-list dmztoinside extended permit tcp host 10.0.10.3 host 10.0.20.3 eq www

access-list dmztoinside extended permit tcp host 10.0.10.3 host 10.0.20.3 eq 5900

access-list dmztoinside extended permit tcp host 10.0.10.3 host 10.0.20.3 eq 5349

access-list dmztoinside extended permit tcp host 10.0.10.3 host 10.0.20.3 eq 5001

access-list dmztoinside extended permit tcp host 10.0.10.3 host 10.0.20.3 eq domain

access-list dmztoinside extended permit udp host 10.0.10.3 host 10.0.20.3 eq domain

access-list dmztoinside extended deny ip any 10.0.0.0 255.0.0.0

access-list dmztoinside extended permit ip 10.0.10.0 255.255.255.0 any

no nat (inside) 1 10.0.10.0 255.255.255.0

nat (dmz) 1 10.0.10.0 255.255.255.0

no static (dmz,outside) 10.0.10.3 yyy.yyy.yyy.yyy netmask 255.255.255.255

static (dmz,outside) yyy.yyy.yyy.yyy 10.0.10.3 netmask 255.255.255.255

access-list outsidedmz extended permit tcp any host yyy.yyy.yyy.yyy eq www

access-list outsidedmz extended permit tcp any host yyy.yyy.yyy.yyy eq https

access-list outsidedmz extended permit tcp any host yyy.yyy.yyy.yyy eq ftp

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 17:09:25 GMT

Thanks, that has part of the problem resolved the web server in the dmz can now access the internet, however the internet still can not access the web server still get page can not be displayed.

Re: ASA 5505 DMZ configuration

kwillacey — Fri, 11 Jul 2008 17:20:48 GMT

The configuration looks fine, have you tried ftp maybe it's just an issue with browsing to the server. Try allowing remote desktop (both server and ASA) and see if that works also.

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 17:36:39 GMT

If I go to my internal server (10.0.20.3) I can open the web page on the dmz web server 10.0.10.3 ok. I can surf the internet using IE from dmz web server ok. If I attempt to access the webpage - http://12.214.95.51/Winnebago/index.asp I get a page can't be displayed. That tells me the web server is ok, but request still aren't making to web server is there any acl to direct all web ports to port 80 as I noticed my request originated on a dynamic port when viewed with net stat -an

Could be that PAT needs to be configured in some way to direct http traffic to web server 10.0.10.3 ??

Re: ASA 5505 DMZ configuration

a.alekseev — Fri, 11 Jul 2008 17:54:55 GMT

what is yyy.yyy.yyy.yyy?

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 17:56:32 GMT

12.214.95.51

Re: ASA 5505 DMZ configuration

a.alekseev — Fri, 11 Jul 2008 18:02:02 GMT

12.214.95.51

is it dhcp assigned ip address to outside interface?

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 18:09:22 GMT

Yes it is supposed to be a "sticky" ip address Media Comm uses them instead of assigning static ip supposedly the 5505 should always get the same ip re assigned. I have tried using the ip address assigned statically to the interface but that makes no difference internet works but can't access web server from internet.

Re: ASA 5505 DMZ configuration

kwillacey — Fri, 11 Jul 2008 18:11:29 GMT

can you verify the ip address on the interface with a show int ip bri

Re: ASA 5505 DMZ configuration

a.alekseev — Fri, 11 Jul 2008 18:19:10 GMT

so in this case

no static (dmz,outside) yyy.yyy.yyy.yyy 10.0.10.3 netmask 255.255.255.255

global(outside) 1 interface

static (dmz,outside) tcp interface 80 10.0.10.3 80

static (dmz,outside) tcp interface 5900 10.0.10.3 5900

static (dmz,outside) tcp interface 5349 10.0.10.3 5349

static (dmz,outside) tcp interface 5001 10.0.10.3 5001

static (dmz,outside) tcp interface 53 10.0.10.3 53

static (dmz,outside) udp interface 53 10.0.10.3 53

[Pls RATE if HELPS]

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 18:32:46 GMT

That looks as if it has done it. I can't access the site from the inside but I had our store pull up the site http://12.214.95.51/winnebago/index.asp ok. Thanks for your help

Re: ASA 5505 DMZ configuration

czone51334 — Fri, 11 Jul 2008 18:34:07 GMT

Yes the IP 12.214.95.51 is correct when checked with the sh int ip bri command

Re: ASA 5505 DMZ configuration

kwillacey — Fri, 11 Jul 2008 19:25:42 GMT

For that you would need to change

static (inside,dmz) 10.0.20.3 10.0.0.3 netmask 255.255.255.255 to

static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0