Having an issue accessing web server from public internet. I set up some PAT rules & permitted the traffic in my outside acl. When I do a packet tracer it says my ASA is configured to allow access to the server from the outside which I include below. Including my ASA config below also. Also when I am inside trying to access the server locally over port 80 or 443 I can successfully access the server webpage. I checked that the web server is set to allow connections from any. All this tells me the server should be working properly.
Mario365# packet-tracer input outside tcp 50.34.68.21 5555 10.0.1.15 443
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static WEBSERVER WEBSERVER destination static interface any service HTTPS HTTPS
Additional Information:
NAT divert to egress interface inside
Untranslate 10.0.1.15/443 to 10.0.1.15/443
Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group acl-outside in interface outside
access-list acl-outside extended permit tcp any object WEBSERVER eq https
Additional Information:
Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static WEBSERVER WEBSERVER destination static interface any service HTTPS HTTPS
Additional Information:
Static translate 50.34.68.21/5555 to 10.0.1.1/5555
Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static WEBSERVER WEBSERVER destination static interface any service HTTPS HTTPS
Additional Information:
Phase: 9
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 10
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 261055, packet dispatched to next module
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
___________________________________________________________
Mario365# sh run
: Saved
:
: Serial Number: JMX1422Z1SF
: Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.2(4)
!
hostname Mario365
enable password Z5tXLWscwJUZOz0q encrypted
passwd Z5tXLWscwJUZOz0q encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
switchport access vlan 3
!
interface Ethernet0/5
switchport access vlan 3
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
security-level 100
ip address 10.0.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Vlan3
no forward interface Vlan1
nameif DMZ
security-level 50
ip address 10.20.10.1 255.255.255.0
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
same-security-traffic permit intra-interface
object network insidenet
subnet 10.0.1.0 255.255.255.0
object service HTTP
service tcp source eq www
object network WEBSERVER
host 10.0.1.15
object service HTTPS
service tcp source eq https
object-group network DENIED-ADDRESSES
network-object host 123.183.209.139
object-group network ANYCONNECT-REMOTE-USERS
network-object 10.0.2.0 255.255.255.0
network-object 10.0.3.0 255.255.255.0
object-group network DMZ-SUBNET
network-object 10.20.10.0 255.255.255.0
access-list acl-inside extended permit tcp any any eq www
access-list acl-inside extended permit tcp any any eq https
access-list acl-inside extended permit udp any any eq domain
access-list acl-inside extended permit icmp any any
access-list acl-inside extended permit icmp any any echo-reply
access-list acl-outside extended permit icmp any any
access-list acl-outside extended permit icmp any any echo-reply
access-list acl-outside extended permit tcp any object WEBSERVER eq www
access-list acl-outside extended permit tcp any object WEBSERVER eq https
access-list acl-outside extended deny ip any any log
access-list acl-DMZ extended permit icmp any any
access-list acl-DMZ extended permit icmp any any echo-reply
access-list acl-DMZ extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging buffer-size 512000
logging buffered debugging
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static WEBSERVER WEBSERVER destination static interface any service HTTP HTTP
nat (inside,outside) source static WEBSERVER WEBSERVER destination static interface any service HTTPS HTTPS
!
object network insidenet
nat (inside,outside) dynamic interface
access-group acl-inside in interface inside
access-group acl-outside in interface outside
access-group acl-DMZ in interface DMZ
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization exec LOCAL
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint LOCALTRUST
enrollment self
fqdn none
subject-name CN=text
keypair SSLVPNKEY
crl configure
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 10.0.2.0 255.255.255.0 inside
ssh 10.0.1.0 255.255.255.0 inside
ssh timeout 60
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside
dhcp-client update dns server both
dhcpd update dns both
!
dhcpd address 10.0.1.100-10.0.1.200 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd lease 604800 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 216.6.2.70 source outside
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:cd90cd6be21439830216cff90bf66130
: end
