topic Re: DMZ access in Network Security

DMZ access

dinesh.das — Mon, 11 Mar 2019 13:00:22 GMT

Hi,

I am not able to access DMZ from outside. Attached the running config of firewall.

I think it might be some routing issue, any suggestions.

Re: DMZ access

massimiliano.serafino — Tue, 17 Jun 2008 08:34:14 GMT

Hi,

Some questions:

- Did you try to ping from outside your host in DMZ?

- When you try to access to host in DMZ do you see log messages on firewall?

- Did you set up the defaul gateway on host in DMZ?

Best regards.

Massimiliano.

Re: DMZ access

dinesh.das — Tue, 17 Jun 2008 08:49:52 GMT

1. i am not able to ping from out side to DMZ nat ip.

2. no

3. Yes

Re: DMZ access

massimiliano.serafino — Tue, 17 Jun 2008 08:58:50 GMT

Hi,

- From outside did you ping the ip address of the firewall's interface outside?

- From host in DMZ did you have access to hosts in Internet?

Re: DMZ access

Farrukh Haroon — Tue, 17 Jun 2008 09:06:09 GMT

First of all your access-list is wrong:

access-list DMZ1_access_in extended permit ip host 1.1.27.113 any

access-list DMZ1_access_in extended permit icmp host 1.1.27.113 any

The 1.1.27.113 will never be seen on the DMZ side, it will only see the pre-nat local IP.

Secondly one of your static's is incorrect:

static (inside,outside) 1.1.27.101 192.168.5.101 netmask 255.255.255.255

This should be 192.168.1.101 OR

static (DMZ1,outside) 1.1.27.101 192.168.5.101 netmask 255.255.255.255

Thirdly, why have you put two default routes?

Regards

Re: DMZ access

dinesh.das — Tue, 17 Jun 2008 09:09:24 GMT

all global ip are responding from out side, except DMZ NAT IP.

Re: DMZ access

Farrukh Haroon — Tue, 17 Jun 2008 09:16:10 GMT

You mean this IP? 1.1.27..113

Try to add this in your DMZ ACL:

access-list DMZ1_access_in extended permit ip host 192.168.5.111 any

You can make it more secure after doing the initial testing.

Secondly fix your static as per my last post.

Regards

Farrukh

Re: DMZ access

dinesh.das — Tue, 17 Jun 2008 09:19:55 GMT

Hi,

thanks a lot, i will implement the config as you said n try to ping from outside.

Regards.

Re: DMZ access

nomair_83 — Tue, 17 Jun 2008 09:25:39 GMT

Hi,

Just do some logging and icmp debugging in ASA then post it here.

did u try a telnet to a server.

Regards

Re: DMZ access

Farrukh Haroon — Tue, 17 Jun 2008 09:30:23 GMT

Omair the issue is with the ACL and the static.

Regards

Farrukh

Re: DMZ access

nomair_83 — Tue, 17 Jun 2008 09:51:02 GMT

Agreed but I hope that he changed the config.

Re: DMZ access

dinesh.das — Wed, 18 Jun 2008 03:16:22 GMT

Thank you Farrukh, it is working now. I think the only problem was ACL_DMZ and that is what it was not comming out of the FW.