ASA 5506 NAT issues.

[jm]

Hi there...

I have recently installed a 5506 at a customer WHO has two servers that needs NAT.

One of them is a web server on a DMZ and i have enabled NAT with a public ip on src: DMZ, dest.:OUTSIDE.

Also i have made two access rules that

• allows OUTSIDE to access the webserver by http/https
• allows webserver to access an INSIDE server on port 587.

it works.. well allmost. The web server cannot access the internet for some reason so i tried to make an access rule that

• allows webserserver to access OUTSIDE on ip

object network Applikation
 host 192.168.2.2

object network Webshop
 host 192.168.253.2

access-list DMZ_access_in extended permit ip object Webshop interface outside
access-list DMZ_access_in extended permit object-group DM_INLINE_SERVICE_1 object Webshop object Applikation

...

object network Webshop
 nat (DMZ,outside) static <public IP>

I am new on Cisco (well its about 14 years since i had anything to do with them) so any explanations would be great.

[Philip D'Ath]

It sounds like you need something like:

access-list DMZ_access_in extended permit ip object Webshop any

[jm]

Hi Philip and thanks.

Well i have tried that but it opens op for access to all. That Means my webserver also have access to the inside Network.

So i have to make deny rules on inside to block the things i dont want in there?

[Philip D'Ath · Accepted solution]

Yes in that case before the line put in another line denying it access to the internal network.

So something like:

access-list DMZ_access_in extended permit ip object Webshop object application
access-list DMZ_access_in extended deny ip object Webshop 192.168.2.0 255.255.255.0
access-list DMZ_access_in extended permit ip object Webshop any

[jm]

Thanks. That worked :)

Have a nice weekend.

Johnny