ASA 5505 From DMZ server to Inside server

[DelWoodcock]

I have a web server on the DMZ that I need to have a specific port (8000) accessing the same port on and INSIDE app server. I have searched and only come up with older examples of configurations and I am running version 9.2(4).

[Pablo · Accepted solution]

Hi,

If you don't need NAT for that connection then there's really nothing to it, you just need to update the DMZ ACL since you're currently blocking all the traffic going to the inside.

Maybe I'm missing something and you want to elaborate on what the requirement is...

__ __

Pablo

[Dennis Mink]

Are you after outside user being able to access two servers? one server in the DMZ, the other server on INSIDE?     i.e.  Port redirection  (static PAT)?

[MANI .P]

Hi ,

I understand that , you have a web server at DMZ . This server outside users are access thru https port . similarly you  want ? . you have app server at inside Zone , so outside users will access the app server thru port 8000 that will re-direct to app server ( local Ip with port 80 ) ?

 
okay .

 
for example :

my app server Inside Zone ip 10.10.10.100 allow 80 port .

My app server assign public ip 1.1.1.1  (when outside users try 1.1.1.1 with port 8000 redirect to 10.10.10.100 port  80 ) 

# object network APP_SRV

#host 10.10.10.100

#object network NAT_IP

#host 1.1.1.1

#object network any_0

#subnet 0 0 

#object service PORT-8000  ( Mapped port )

#service tcp source eq 8000

#object service PORT-80    (my inside App server port )

#service tcp source eq 80

#nat (inside,outside) source static APP_SRV NAT_IP destination static  any_0   any_0 service PORT-80    PORT-8000

Allow ACL to inside interface 

# access-list outside_access_in extended permit tcp any host  APP_SRV 

Rate if this helps you .

Thanks,

Mani.

------------------------------------------------------------------------------------------------------------

[DelWoodcock]

Added the following line to the dmz_acl and it worked:

access-list dmz_acl extended permit tcp host 192.168.1.100 host 10.10.10.214 object-group Activity