I have inside network 172.16.0.0/24 , 172.16.1.0/24 , 172.16.2.0/24 , 172.16.3.0/24 ,it connect to a layer3 switch.
Layer3 switch connect to asa,network address is 192.168.0.0 /30.
DMZ network address is 172.16.4.0/24
My inside network can go outside to internet and go to DMZ watch the web page.
But DMZ can't go to inside network to get domain or inside server's service.
What should i do to my running config.
Here is my asa running config:
ASA Version 8.0(2)
!
hostname asa
domain-name abc.edu.hk
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 172.18.36.171 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.252
!
interface Ethernet0/2
nameif dmz
security-level 50
ip address 172.16.4.254 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 0
ip address 10.0.10.1 255.255.255.0
management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name abc.edu.hk
access-list dmz extended permit ip any host 172.16.3.5
access-list dmz extended permit ip any host 172.16.3.6
access-list dmz extended permit ip any host 172.16.3.7
access-list dmz extended permit ip any host 172.16.3.8
access-list dmz extended permit ip any host 172.16.3.9
access-list dmz extended permit ip any host 172.16.3.10
access-list dmz extended deny ip any 172.16.3.0 255.255.255.0
access-list dmz extended permit ip any any
access-list dmz extended permit gre any any
access-list dmz extended permit icmp any any echo-reply
access-list outside extended permit tcp any host 172.18.36.171
access-list outside extended permit gre any any
access-list outside extended permit icmp any any echo-reply
access-list inside extended permit ip any any
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (DMZ) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.252
nat (inside) 1 172.16.0.0 255.255.0.0
nat (outside) 1 172.18.36.0 255.255.255.0
nat (DMZ) 1 172.16.4.0 255.255.255.0
static (DMZ,outside) tcp interface ssh 172.16.4.5 ssh netmask 255.255.255.255
static (DMZ,outside) tcp interface 81 172.16.4.5 81 netmask 255.255.255.255
static (DMZ,outside) tcp interface https 172.16.4.5 https netmask 255.255.255.255
static (DMZ,outside) tcp interface www 172.16.4.5 www netmask 255.255.255.255
static (DMZ,outside) tcp interface 990 172.16.4.5 990 netmask 255.255.255.255
static (DMZ,outside) tcp interface pptp 172.16.4.5 pptp netmask 255.255.255.255
access-group inside in interface inside
access-group outside in interface outside
access-group dmz in interface DMZ
route outside 0.0.0.0 0.0.0.0 172.18.36.254 1
route inside 172.16.0.0 255.255.255.0 192.168.0.2 1
route inside 172.16.1.0 255.255.255.0 192.168.0.2 1
route inside 172.16.2.0 255.255.255.0 192.168.0.2 1
route inside 172.16.3.0 255.255.255.0 192.168.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:42666bc2bfd3b1e7394b653157ba1b61
: end
