DMZ to outside Cisco ASA 5505

[ChristopheVL]

Hi,

i have problem configuring DMZ to access outside.

I'm not able to ping from DMZ network to DMZ interface (gateway) neither am i able to contact the internet with DMZ hosts

I'm able to ping from LAN to LAN gateway (inspect ICMP service policy)

interface Vlan1
 nameif inside
 security-level 100
 ip address 10.1.1.254 255.0.0.0
!
interface Vlan2
 description Connection to Internet
 nameif outside
 security-level 0
 pppoe client vpdn group Dial_Belgacom
 ip address pppoe setroute
!
interface Vlan12
 description DMZ
 nameif DMZ
 security-level 50
 ip address 172.20.1.254 255.255.255.0

access-list DMZ_access_in extended permit ip object NetworkDMZ any
access-list DMZ_access_in extended deny ip object NetworkDMZ any

object network in-out
 nat (inside,outside) dynamic interface
object network DMZ-Out
 nat (DMZ,outside) dynamic interface

access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ

Thanks,

Christophe

[Marius Gunnerud · Accepted solution]

Do you have the security plus license installed?

Are using a single ASA interface? if so, is that port configured to be a trunk?

Have you tried a shut / no shut on the DMZ interface?

Have you tried removing the configuration from the DMZ interface and re adding it?

Have you made 100% sure that the IP you are testing from in the DMZ network is within the subnet 172.20.1.0/24?

What is between the ASA and the test PC? (switch, L3 switch, router...etc.)

If you configure a port on the ASA to be in vlan 12 and connect a PC directly to that port, do you get a successful test?

--

Please remember to select a correct answer and rate helpful posts

[ChristopheVL]

Hi Marius,

Thanks for your fast reply.

The problem was that the DMZ interface was in access mode and not trunk.

Thanks for the help

Christophe