topic Cannot access my web server located on DMZ in Network Security

Cannot access my web server located on DMZ

Rowlands Price — Fri, 21 Feb 2020 15:50:44 GMT

Dear Support

Recently i installed a web server on my DMZ zone.

My network is with two firewalls, one sophos and Cisco ASA 5525 (cf network design attached)

The server in dmz has ASA ip like default-gateway, the webserver reach internet easly and from Internet we can also reach the webserver installed in dmz

My isssue is that from inside network we cannot reach the webserver, we have this error message

Deny TCP(no connection) from 10.4.11.3/8080 to 192.192.0.10/58495 flags SYN ACK on interface inside

Inbound TCP connection denied from 10.4.11.3/8080 to 192.192.0.10/59535 flags SYN ACK on interface inside

can anybody help us how can we reach our webserver from inside

Regards

Re: Cannot access my web server located on DMZ

Dennis Mink — Mon, 04 Jun 2018 05:48:10 GMT

Can you send the config of the inner ASA. so we can check your ACL and NAT?

cheers

Re: Cannot access my web server located on DMZ

Rowlands Price — Mon, 04 Jun 2018 06:58:56 GMT

Dear Dennis

attache is the asa config

Regards

Re: Cannot access my web server located on DMZ

Florin Barhala — Tue, 05 Jun 2018 10:35:03 GMT

The simplest solution would be that you add a static route on the DMZ server for 192.192.0.0/24 or /16 with next-hop 10.4.11.2.

Now the trick would be, what if you had 100 DMZ servers instead of just one, or what if you cannot alter DMZ server network config. In this case I have two more ideas
- setup a policy based routing policy on the Sophos firewall and ask that traffic with src LAN and destination 10.4.11.3 go to next-hop 10.4.11.1
- play with ASA TCP Bypass config; here's a very good example.

Re: Cannot access my web server located on DMZ

Rowlands Price — Tue, 05 Jun 2018 11:06:46 GMT

Many Thanks Florian

So you are right, if we have a lot server in dmz, it will be difficult to manage.

I think the best and simply way is to use a third interface on the ASA and all dmz servers will be hosted behind the third ASA interfaces.

what do you think about this ?

so all traffic from inside network will enter asa before going to dmz server.

Re: Cannot access my web server located on DMZ

Florin Barhala — Tue, 05 Jun 2018 12:02:22 GMT

That would also make it!
But consider if sophos firewall is required for any DMZ service. If I were you, I would pick the easy way for now or the 3rd option and get "deeper" with Cisco ASA : ))