Hello,
I have implemented ASA 5516-x with inside, dmz, outside network.
Inside can connect to dmz (both local hostname and public IP/hostname)
outisde can connect to dmz (public IP/hostname)
Any dmz server tries to connect to the Public Server (Public IP) timesout.
Form example.:
We have a SharePoint server and a OWA server in the DMZ
I try to connect to the https://owa.publichost.ca from the Sharepoint server it timesout
I try to connect to SharePoint https://sharepoint.publichost.ca from within the server timesout
This what shows on the packet-tracer. Maybe i'm just missing a simple NAT entry here.
acdfw01/pri/act# packet-tracer input dmz tcp 172.16.1.59 https 204.x.x.59 $
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 204.x.x.59 using egress ifc outside
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group DMZ_access_in_2 in interface DMZ
access-list DMZ_access_in_2 extended permit object-group DM_INLINE_SERVICE_3 any any
object-group service DM_INLINE_SERVICE_3
service-object icmp
service-object tcp destination eq https
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad8a9b910, priority=13, domain=permit, deny=false
hits=6333303, user_data=0x2aaacdb91b40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=DMZ, output_ifc=any
Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
object network 172.16.1.59
nat (DMZ,outside) static 204.x.x.59
Additional Information:
Static translate 172.16.1.59/443 to 204.x.x.59/443
Forward Flow based lookup yields rule:
in id=0x2aaada9c3c50, priority=6, domain=nat, deny=false
hits=66691, user_data=0x2aaad94fa9f0, cs_id=0x0, flags=0x0, protocol=0
src ip/id=172.16.1.59, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=DMZ, output_ifc=outside
Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad743f9a0, priority=0, domain=nat-per-session, deny=false
hits=27614153, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad7fe9290, priority=0, domain=inspect-ip-options, deny=true
hits=15977519, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=DMZ, output_ifc=any
Phase: 6
Type: SFR
Subtype:
Result: ALLOW
Config:
class-map sfr-class
match any
policy-map global_policy
class sfr-class
sfr fail-open
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad8cdb490, priority=71, domain=sfr, deny=false
hits=12165863, user_data=0x2aaad8cd8af0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=DMZ, output_ifc=any
Phase: 7
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad8217180, priority=20, domain=lu, deny=false
hits=7703373, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=DMZ, output_ifc=any
Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (sp-security-failed) Slowpath security checks failed
acdfw01/pri/act#
Thanks
