Allowing certain outside IPs to enter DMZ

[KCMM14457]

Hello,

I have a DMZ setup for our new SFTP server. I'm trying to make it where only specific outside IPs can get into this sever. Do I need to create a NAT rule or ACL on our ASA5512? 

Thank you,

[Sheraz.Salim]

you need nat rules and ACL both. now you only want specific ip addresses in that case here is the example

!

object network dmz-host-real

  host 192.168.100.1

!

object network dmz-host-mapped

 host 67.54.23.11

!

nat (dmz,outside) source static dmz-host-mapped

!

access-list dmz_in exten permit tcp host 55.55.55.55 object dmz-host-real eq 22

access-group in interface dmz

!

For example 55.55.55.55. is your specific outside public address which need access to SFTP server.

[KCMM14457]

Since ill be have a few outside IPs that need to be allowed in, can you create an object group and then create an ACL to allow that group in? Right now I only have this ACL in place:
access-list inbound extended permit tcp any object SFTP_SERVER eq 22

[Sheraz.Salim]

yes you can do this.

!

object network dmz-host-real
host 192.168.100.1
!
object network dmz-host-mapped
host 67.54.23.11
!

object-group network OUTSIDE_IP
network-object host 55.55.55.55
network-object host 22.22.22.22
!
nat (dmz,outside) source static dmz-host-mapped
!
access-list dmz_in extended permit tcp object-group OUTSIDE_IP object dmz-host-real eq ssh
access-group in interface dmz
!

[KCMM14457]

So where you have the access-list TEST, does TEST represent inbound like the ACL i have now or is it going to be the SFTP_SERVER?

[Sheraz.Salim · Accepted solution]

object network dmz-host-real
host 192.168.100.1
!
object network dmz-host-mapped
host 67.54.23.11
!

object-group network OUTSIDE_IP
network-object host 55.55.55.55
network-object host 22.22.22.22
!
nat (dmz,outside) source static dmz-host-mapped
!
access-list dmz_in extended permit tcp object-group OUTSIDE_IP object dmz-host-real eq ssh
access-group in interface dmz

above configuration change the name according to your needs.