I have an ISP that has given us a 32 IP Block (30 IPs addressable). I have a switch which the inside interface of the ISP router is connected to. From another port on this switch I have connected to the Outside interface of the ASA. All this works as expected with no issues.
We have been asked to setup a second connection using another IP address from this block that needs to be in the DMZ. The router that will be supplied will establish a tunnel. We need to supply them the public IP and gateway as well as the internal IP before they ship the router to us. So I created a DMZ port on this firewall and connected that to a new router that can establish a tunnel. I used a private network and have a /30 IP scheme between this new router and the DMZ interface of the firewall. This too works fine. I can ping the inside and outside interfaces of the firewall wall as well as external web addresses.
The goal is to allow remote support connect to this new router via their established VPN tunnel to manage our servers on our internal network. What I cannot get to work currently is a ping from our internal network to the 172.16.6.2 DMZ address. I can see the packets hitting the firewall and a connection setup and teardown in the logs. I am sure I am making this out to be more complicated than it needs to be but the last thing I want to do it mess up the config of an active firewall.
Built inbound ICMP connection for faddr 10.5.9.1/4 gaddr 172.16.6.2/0 laddr 172.16.6.2/0
Teardown ICMP connection for faddr 10.5.9.1/4 gaddr 172.16.6.2/0 laddr 172.16.6.2/0
What I am not getting, is any replies. I am thinking this is a NAT issue more than a routing issue. I do have a route in my core stating 172.16.6.0 /30 10.5.100.110 /16 which the inside ip address of our firewall is 10.5.100.110.
I have not setup any NAT statements for the DMZ yet as I am not sure if I need to setup a static NAT or a dynamic NAT. I just need traffic that is destined from the 10.5.x.x /16 to the 172.16.6.x /30 to be forwarded to this DMZ. I also need to make sure that any traffic from this DMZ network can access our internal network. Of course once this is working I plan to lock down the specific ports they require.
Since this is an active firewall with a separate VPN already established I cannot affect any traffic that is already setup to use the existing outside interface of the firewall.
I have attached a sanitized screen shot of my logical layout for a clearer understanding of my question. Thank you very much in advance.
