Cannot access my web server located on DMZ

[Rowlands Price]

Dear Support

Recently i installed a web server on my DMZ zone.

My network is with two firewalls, one sophos and Cisco ASA 5525 (cf network design attached)

The server in dmz has ASA ip like default-gateway, the webserver reach internet easly and from Internet we can also reach the webserver installed in dmz

My isssue is that from inside network we cannot reach the webserver, we have this error message

Deny TCP(no connection) from 10.4.11.3/8080 to 192.192.0.10/58495 flags SYN ACK on interface inside

Inbound TCP connection denied from 10.4.11.3/8080 to 192.192.0.10/59535 flags SYN ACK on interface inside

can anybody help us how can we reach our webserver from inside

Regards

[Dennis Mink]

Can you send the config of the inner ASA. so we can check your ACL and NAT?

cheers

[Rowlands Price]

Dear Dennis

attache is the asa config

Regards

[Florin Barhala · Accepted solution]

The simplest solution would be that you add a static route on the DMZ server for 192.192.0.0/24 or /16 with next-hop 10.4.11.2.

Now the trick would be, what if you had 100 DMZ servers instead of just one, or what if you cannot alter DMZ server network config. In this case I have two more ideas
- setup a policy based routing policy on the Sophos firewall and ask that traffic with src LAN and destination 10.4.11.3 go to next-hop 10.4.11.1
- play with ASA TCP Bypass config; here's a very good example.

[Rowlands Price]

Many Thanks Florian

So you are right, if we have a lot server in dmz, it will be difficult to manage.

I think the best and simply way is to use a third interface on the ASA and all dmz servers will be hosted behind the third ASA interfaces.

what do you think about this ?

so all traffic from inside network will enter asa before going to dmz server.

[Florin Barhala]

That would also make it!
But consider if sophos firewall is required for any DMZ service. If I were you, I would pick the easy way for now or the 3rd option and get "deeper" with Cisco ASA : ))