ASA 5510 , can not access the server in DMZ from outside

[Muhammad Azhar]

Hi Every one,

I get stuck in a problem, i need your help in this regard.

Scenior is very simple ---->   Inside-Pc----->Switch 3560----->(inside) ASA5510 (outside)------>ISP

                                                                                                                |

                                                                                                                |

                                                                                                           DMZ Server

My configuration is of ASA is

access-list TEST permit ip any host x.x.x.x   (where x.x.x.x is my live IP to access server in DMZ)

access-group TEST in interface outside

static (dmz,outside) x.x.x.x 192.168.2.2          (where x.x.x.x is Live IP, the same i mention in my ACL TEST)

route outside 0.0.0.0 0.0.0.0 x.x.x.y   (where x.x.x.y is my ISP ...default route to ISP).

interface eth0/0

des Connected to ISP

ip add x.x.x.x 255.255.225.248

nameif outside

security-level 0

no sh

interface eth0/1

des *****INSIDE*********

nameif inside

ip add 10.10.10.1 255.255.255.252

security-level 100

no sh

interface eth0/2

des *******DMZ******

nameif dmz

security-level 50

no sh

ip add 192.168.2.1 255.255.255.0

When i use the ASA we can access the server in dmz from internt, but when we use the router 2800  ( on which i have use some static mapping for same server)  then it work fine. My DMZ machine can ping the ASA dmz interface and vice versa.

I have even test the same on GNS3 and it working.

What can be the reason for not working my config or any other reason that can be ..............your response will be appreciated.

[varrao]

Hi Muhammad,

Can you run thisd packet tracer and give me the output:

packet-tracer input outside tcp 1.1.1.1 2345 xx.xx.xx.xx 80 detailed

this would help in identifying, moreover, take captures:

https://supportforums.cisco.com/docs/DOC-1222

Hope this helps,

Thanks,

Varun

[NAGISWAREN2]

Have DMZ access-list allow DMZ host to reach external?

eq

access-lest dmz-in permit ip host 192.168.2.2 any

access-group dmz-in dmz in

And is the service (which you trying to aceess the server) has been enabled for inspection in global service policy?

[jurgendendas]

Hello

What OS are you running?

Kind regards

[Muhammad Azhar]

All, Thanks for your response.

Problem was sort out. Actually the problem was at service provider side.Configuration was fine and now working.

Regards

Date: Fri, 12 Aug 2011 02:56:48 -0600

From: supportforums-donotreply@jivesoftware.com

To: azharafp@hotmail.com

Subject: - Re: ASA 5510 , can not access the server in DMZ from outside

Cisco Support Community

Re: ASA 5510 , can not access the server in DMZ from outside

created by jurgen Dendas in Firewalling - View the full discussion

Hello What OS are you running? Kind regards

Reply to this message by going to Cisco Support Community

Start a new discussion in Firewalling at Cisco Support Community