topic Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ in Network Security

ASA 5512 outside can not access ACS server through HTTPS in DMZ

supermanwwc — Fri, 21 Feb 2020 15:09:41 GMT

Hello,there may be some problems with the ASA's config, but I can find where are the problems.

Below is the basic config for this ASA:

DMZ ip address :　192.168.3.254/24

Outside ip address: 125.35.20.188/26

acs server ip address: 192.168.3.240/24 acs server version 5.2

DMZ access ACS server through HTTPS https:// 192.168.3.240/acsadmin successfully

Outside access ACS server through HTTPS https:// 192.168.3.240/acsadmin failed

https:// 125.35.20.145/acsadmin failed

where are the problems.thanks!

Please get the detailed config in the attached file

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

denilson.mota — Thu, 18 Jan 2018 10:43:17 GMT

Can you enable traffic from the lower security level to high security level and try it again.

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

Cheers

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Ajay Saini — Thu, 18 Jan 2018 11:29:48 GMT

Hello,

The config looks okay, can you please take syslogs on ASA and attach here.

Also, could be an issue over internet routing for the NAT ip address 125.35.20.145.

You can take a capture:

capture capo interface outside match tcp any host 125.35.20.145

then initiate traffic from outside and take output of 'show cap capo'

Please take syslogs and attach these outputs. Same Security commands is not required since the security level is different for these interfaces.

HTH

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Pawan Raut — Thu, 18 Jan 2018 18:35:16 GMT

Can you check you have proper ACL and NAT rule on ASA. Could you do packet-tracer on ASA

packet-tracer input outside tcp <sourec ip> 1025 <ACS IP address> 443 de

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

supermanwwc — Fri, 19 Jan 2018 02:02:04 GMT

Thank you very much for your advice。

I didn't change any configuration，I tried again today，only this command to collect logs （capture capo interface outside match tcp any host 125.35.20.145 ）。

https://125.35.20.145/acsadmin/login.jsp successfully from Outside.

Please see the attached document，THAK YOUR VERY MUCH AGAIN.

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

supermanwwc — Fri, 19 Jan 2018 02:05:10 GMT

Thank you very much for your help.

but security level is different。

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

supermanwwc — Fri, 19 Jan 2018 02:13:06 GMT

Thank you very much for your help.

packet-tracer input outside tcp <sourec ip> 1025 <ACS IP address> 443 ，Why is the 1025 port？

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Pawan Raut — Fri, 19 Jan 2018 02:46:50 GMT

1025 is just random source port you can take any port above 1024

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Ajay Saini — Sun, 21 Jan 2018 04:53:31 GMT

Hello,

From what I can tell, this is purely client-server issue and not a firewall issue. I checked the captures you attached, and:

-There is clearly a 3-way handshake done successfully

-There is a reset then sent from 218.247.232.86 at a certain time, could be the application specific traffic.

Couple of more things to figure out the issue:

1. Is the same traffic working from behind the firewall

2. Is there a WAF (Web Application Firewall) or any other appliance that could be causing this issue

3. There could be an IPS issue as well.

-HTH

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

supermanwwc — Mon, 22 Jan 2018 02:25:56 GMT

Thank your for your suggestion. It is very useful for us.

topic Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ in Network Security

ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Re: ASA 5512 outside can not access ACS server through HTTPS in DMZ

Thank your for your suggestion. It is very useful for us.