Cisco ASA 5505: www through different interface

[thiesy123]

Hi,

we are using Cisco ASA 5505 Vers. 9.2(4) with basic license (2 VLANs and dmz restricted) with the following configuration:

interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.200.32 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.222.100 255.255.255.0
!
interface Vlan3
 no forward interface Vlan1
 nameif DMZ
 security-level 0
 ip address 192.168.0.222 255.255.255.0

Outside devices are inside a locked network (for device testing).

From here only a few servers in inside network (smtp, smb) can be reached via access and nat rules.

But now these outside devices need internet access via dmz. (cable router with internal ip 192.168.0.9)

How can this be done since policy based routing (pbr) isn't available for Version 9.2(4)?

Thanks for help.

Best regards,

thiesy

[dbriceno · Accepted solution]

Hello, Thiesy:

If I understand correctly, what you need to accomplish is that the hosts that are coming from the Outside interface get destined to the Internet via the DMZ interface, is this correct?

If so, on which interface is the default gateway of the ASA configured?

Thanks!

-Diego

[thiesy123]

Hi Diego,

you're right: outside hosts need to be directed to the internet via DMZ interface.

Until now, there is no default gateway, because every interconnection is directed via access and nat rules.

Inside hosts have their own default gateway at 192.168.200.8. Not worth mentioning, because this is separate from the ASA. Internet via DMZ should be isolated from this. (different access, different isp)

output of "show route":

C        192.168.0.0 255.255.255.0 is directly connected, DMZ
L        192.168.0.222 255.255.255.255 is directly connected, DMZ
C        192.168.200.0 255.255.255.0 is directly connected, inside
L        192.168.200.32 255.255.255.255 is directly connected, inside
C        192.168.222.0 255.255.255.0 is directly connected, outside
L        192.168.222.100 255.255.255.255 is directly connected, outside

Thanks,

thiesy

[dbriceno]

Hello, Thiesy:

If you just need hosts going out of the DMZ then you can use that interface as the default gateway of the unit, since you stated that you have none.

Note that this route will be global since, as mentioned, there is no PBR function until version 9.4, so any packet that gets to the ASA destined to any unknown route for the ASA will be sent over that interface. This will work for the outside hosts, as well as for any inside host that sends packets to the ASA.

Thanks, and please help us rating useful commets!  :)

-Diego

[thiesy123]

Hi Diego,

"show route" now says

S*    0.0.0.0 0.0.0.0 [1/0] via 192.168.0.9, outside

S - static, * - candidate default

packettracing to cablerouter works (ip port 80 from outside 192.168.222.99 to dmz 192.168.0.9)

That does NOT work from outside: ping 192.168.0.9, http://192.168.0.9, ping 8.8.8.8

What about access and nat rules?

Thanks, thiesy

[thiesy123]

Hi Diego,

do you have any other suggestions?

Thanks, thiesy

[thiesy123]

Hi,

anybody else who can help?

Thanks, thiesy

[Peter Koltl]

Post the config here.

The route 0.0.0.0 command must be changed from outside to DMZ direction.

[Peter Koltl]

Success, thiesy?

[thiesy123]

Thanks Peter for your help.

I changed default route, but I still can't reach router 192.168.0.9 (DMZ) or internet adresses from outside-devices.

Syslog:

22:04:38: %ASA-6-302020: Built inbound ICMP connection for faddr 192.168.222.250/1 gaddr 192.168.0.9/0 laddr 192.168.0.9/0
22:04:41: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.222.250/1 gaddr 192.168.0.9/0 laddr 192.168.0.9/0

22:07:37: %ASA-6-302020: Built inbound ICMP connection for faddr 192.168.222.250/1 gaddr 8.8.8.8/0 laddr 8.8.8.8/0
22:07:39: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.222.250/1 gaddr 8.8.8.8/0 laddr 8.8.8.8/0

packettracing always results in allowed packets.

dmz-interface gets IP from DHCP: 192.168.0.12. No change if I use static IP.

Here's my config:

Result of the command: "show conf"

: Saved
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
: Written by admin at 21:57:39.219 CEDT Thu Apr 14 2016
!
ASA Version 9.2(4)
!
hostname ciscoasa
domain-name .....
enable password .....
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd .....
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
 switchport access vlan 3
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.200.32 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.222.100 255.255.255.0
!
interface Vlan3
 no forward interface Vlan1
 nameif DMZ
 security-level 0
 ip address dhcp setroute
!
boot system disk0:/asa924-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
 domain-name .....
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network mailsvr_int
 host 192.168.200.6
object network smbsvr_int
 host 192.168.200.8
object network vdf-router_dmz
 host 192.168.0.9
object service tcp-snmp
 service tcp destination eq 161
object service tcp-snmptrap
 service tcp destination eq 162
object network obj_any_int
 subnet 192.168.200.0 255.255.255.0
object service tcp-modbus
 service tcp destination eq 502
object service tcp-x11
 service tcp destination eq 6003
object service tcp-http81
 service tcp destination eq 81
object service udp-http81
 service udp destination eq 81
object-group service DM_INLINE_SERVICE_2
 service-object icmp
 service-object object tcp-snmp
 service-object object tcp-snmptrap
 service-object udp destination eq snmp
 service-object udp destination eq snmptrap
 service-object object tcp-modbus
 service-object tcp destination eq ftp
 service-object tcp destination eq ftp-data
 service-object tcp destination eq ssh
 service-object udp destination eq tftp
 service-object object tcp-x11
 service-object object tcp-http81
 service-object tcp-udp destination eq www
 service-object tcp destination eq https
 service-object object udp-http81
object-group protocol DM_INLINE_PROTOCOL_1
 protocol-object ip
 protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_2
 protocol-object ip
 protocol-object icmp
access-list outside_access_in extended permit tcp any4 object mailsvr_int eq smtp
access-list outside_access_in extended permit tcp any4 eq smtp interface outside eq smtp
access-list outside_access_in extended permit tcp any4 object mailsvr_int eq pop3
access-list outside_access_in extended permit tcp any4 interface outside eq pop3
access-list outside_access_in extended permit udp any4 object smbsvr_int eq netbios-ns
access-list outside_access_in extended permit udp any4 object smbsvr_int eq netbios-dgm
access-list outside_access_in extended permit tcp any4 object smbsvr_int eq netbios-ssn
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any4 object vdf-router_dmz
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any4 object obj_any
access-list DMZ_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
pager lines 24
logging enable
logging timestamp
logging trap informational
logging asdm informational
logging host inside 192.168.200.36 17/1025
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-752-153.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
 nat (inside,outside) dynamic interface
object network mailsvr_int
 nat (inside,outside) static mailsvr_int no-proxy-arp route-lookup
object network smbsvr_int
 nat (inside,outside) static smbsvr_int no-proxy-arp route-lookup
object network vdf-router_dmz
 nat (DMZ,outside) static vdf-router_dmz
object network obj_any_int
 nat (inside,outside) static obj_any_int no-proxy-arp
access-group outside_access_in in interface outside
access-group DMZ_access_in in interface DMZ
route DMZ 0.0.0.0 0.0.0.0 192.168.0.9 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.200.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcp-client client-id interface DMZ
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username admin password .....
username admin attributes
 password-storage disable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily

Thanks for help,

thiesy

[Peter Koltl]

You need dynamic NAT from outside to DMZ as the cable router has no knowledge of outside (192.168.222.0) subnet.

object network outside222
  nat (outside,DMZ) dynamic interface

[thiesy123]

Great, that was successful! Thanks a lot.

Now the only thing missing is DNS. The ASA should forward DNS-requests to 192.168.200.8 (inside-network)

For inside-clients the ASA is already forwarding DNS-requests to 192.168.200.8 after configuration at Configuration > Device Management > DNS > DNS Client

[Peter Koltl]

That menu function is not necessary for client DNS requests to access DNS server.

You already have a static identity NAT for smbsvr_int so a client in outside zone can access 192.168.200.8 if you set it to use that DNS server.