cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


164
Views
0
Helpful
2
Replies
Highlighted
Beginner

ASA DMZ Server access

Hi,

 

If I have one DMZ webserver ( on port 443) in my environment and I want it to use outside interface for PAT.

!

object network DMZ_SERVER_PRIVATE

host 172.16.1.10

nat (dmz, outside) static interface service tcp https https

!

Now,  I also have https/ASDM access enabled for ASA ( to the box traffic).

 

When someone tries to connect to my outside IP on 443 how my firewall will know if he's trying to access ASA/ASDM (to the box traffic) or internal WEB server(through the box traffic)?

 

Thanks.

 

 

 

Everyone's tags (1)
2 REPLIES 2
Beginner

Re: ASA DMZ Server access

Hi,

 

  1. Enable the HTTPS server to listen on a different port in order to change the configuration that is related to the ASDM service on the ASA, as shown here:
    ASA(config)#http server enable <1-65535>

    configure mode commands/options:
    <1-65535> The management server's SSL listening port. TCP port 443 is the
    default.
    Here is an example:
    ASA(config)#http server enable 65000
  2. After you change the default port configuration, use this format in order to launch the ASDM from a supported web browser on the security appliance network:
    https://interface_ip_address:<customized port number>

     

Don't forget to permit your public IP to access ASDM with this CLI :

http [your public IP] 255.255.255.255 outside
! or all public IP :
http 0.0.0.0 0.0.0.0 outside

 

HTH

Beginner

Re: ASA DMZ Server access

Hi,

Thank you for your reply.

But the thing is that I implemented this in GNS and it showed that it directed that connection to DMZ server.

Why the firewall did not consider it as to the box traffic?

 

WEB_PRIV----- (dmz) [ASA](outside)----- outside router 

 

I have trimmed the output to show only relevant info.

 

ciscoasa# show run http
http server enable
http 10.0.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside

 

ciscoasa# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
GigabitEthernet0/0 outside 20.0.0.1 255.255.255.0 CONFIG
GigabitEthernet0/1 inside 10.0.0.1 255.255.255.0 CONFIG
GigabitEthernet0/2 dmz 172.16.0.1 255.255.255.0 CONFIG

 

ciscoasa# sho run object
object network WEB_PRIV
host 172.16.0.5

!

ciscoasa# show run nat
!
object network WEB_PRIV
nat (dmz,outside) static interface service tcp https https

!

ciscoasa# show run access-list

access-list OUTSIDE_IN extended permit tcp any object WEB_PRIV eq https

!

outside_router#telnet 20.0.0.1 443
Trying 20.0.0.1, 443 ... Open

 

WEB_PRIV#show tcp brief
TCB                   Local Address       Foreign Address     (state)
65496C80      172.16.0.5.443      20.0.0.10.29126      ESTAB

 

 

Everyone's tags (1)