topic Re: DMZ accesing internal network on ASA in Network Security

DMZ accesing internal network on ASA

mcelec — Mon, 11 Mar 2019 12:21:07 GMT

Hi people,

in a 5510 ASA I need to install some public servers in DMZ interface, some of them need to get access to internal network, however, I put a static and the access-list to do that, but logging says theres not translation between them (DMZ and Internal) what do I need to do, is there some aditional configuration?

In fac, my servers are working fine with a static and the access-list for them, and they can be accessed form internet with no problem,

can somebody help me please ??

Martin

Re: DMZ accesing internal network on ASA

sundar.palaniappan — Sun, 23 Mar 2008 17:26:01 GMT

Martin,

Can you post the static and access list you are using.

Which direction are you initiating the traffic - from inside to DMZ or DMZ to inside?

Re: DMZ accesing internal network on ASA

mcelec — Tue, 25 Mar 2008 17:44:42 GMT

Hi sundar, I need to get access from DMZ's host to inside's host (email server).

thanks for your help

Martin

Re: DMZ accesing internal network on ASA

derrickc — Tue, 25 Mar 2008 18:22:37 GMT

It looks like the access-list "DMZ_access_in" may have an error. You are permitting the real DMZ IP address to the NAT'd inside address. Wouldn't you want to permit it to the inside server (the one you are trying to communicate with). For example:

access-list DMZ_access_in extended permit ip host 192.168.150.33 host

Re: DMZ accesing internal network on ASA

sundar.palaniappan — Tue, 25 Mar 2008 19:10:00 GMT

Martin,

Yes, as the previous poster indicated you need to permit the host on the DMZ (192.168.150.33) to access the device (inside host) in your DMZ ACL. Alternatively, you can configure the DMZ host access the entire inside network as follows.

access-list DMZ_access_in extended permit ip host 192.168.150.33 172.25.1.0 255.255.255.0

HTH

Sundar

Re: DMZ accesing internal network on ASA

cjake7777 — Tue, 25 Mar 2008 19:23:55 GMT

It looks like your "static (DMZ,inside) 172.25.1.1 192.168.150.33 netmask 255.255.255.255" statement is in error. Its saying that 192.168.150.33 is the same device as 172.25.1.1? I dont think you are trying to do that, take it out, then it should work.

Re: DMZ accesing internal network on ASA

mcelec — Tue, 25 Mar 2008 19:24:44 GMT

Hi,

I modifyed the access-list

access-list DMZ_access_in extended permit ip host 192.168.150.33 172.25.1.0 255.255.255.0

but it is not working still.

logging message:

No translation group found for icmp src DMZ:192.168.150.33 dst inside:172.25.1.1 (type8, code0)

please, any aditional comment

Martin

Re: DMZ accesing internal network on ASA

sundar.palaniappan — Tue, 25 Mar 2008 19:33:49 GMT

We misunderstood your requirement. It looks like you are trying to get 192.168.150.33 talk to 172.25.1.1, correct?

If it is then change the static as follows and test.

no static (DMZ,inside) 172.25.1.1 192.168.150.33 netmask 255.255.255.255

static (DMZ,inside) 192.168.150.33 192.168.150.33 netmask 255.255.255.255

Keep the access list one of two ways.

access-list DMZ_access_in extended permit ip host 192.168.150.33 host 172.25.1.1

(or)

access-list DMZ_access_in extended permit ip host 192.168.150.33 172.25.1.0 255.255.255.0

Re: DMZ accesing internal network on ASA

cjake7777 — Tue, 25 Mar 2008 19:48:48 GMT

A way to get around "static (DMZ,inside) 192.168.150.33 192.168.150.33 netmask 255.255.255.255" is nat 0 statements. ex:

access-list 100 extended permit ip 172.25.1.0 255.255.255.0 192.168.150.0 255.255.255.0

nat (inside) 0 access-list 100

I just hate those crazy static statements....Just a suggestion

Re: DMZ accesing internal network on ASA

mcelec — Tue, 25 Mar 2008 22:28:39 GMT

Thanx very much folks for your help,

I do not know why Static and ACL is not working yet, but, nat 0 is working, then, I gonna install nat 0 config because I really need it, but I would like to know a nice document about this configuration, somebody knows a nice pdf about that ??

Martin

Re: DMZ accesing internal network on ASA

sundar.palaniappan — Wed, 26 Mar 2008 00:14:01 GMT

Martin,

The static identify nat I had suggested earlier should have worked as well. Did you do a 'clear xlate' after making the configuration change?

As you are probably aware the static identity nat and nat 0 should produce the same result, which is to pass traffic without IP translation.

The following link has examples for both.

http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/cfgnat.html#wp1043458

HTH

Sundar