DMZ host is not accessible from outside/internet

[drlbaluyut]

Hi

I cannot access my trend micro mobile device manager from outside using this link to download the mdm agent.

http://outside_interface_public_ip:8080/mobile

https://outside_interface_public_ip:4343/mobile

My mdm is a DMZ host with ip 172.29.29.2 and nat rule to translate 172.29.29.2 to outside_interface_public_ip

nat (DMZ,outside) static interface service 

I have access rule on outside to permit any to real ip of dmz host with service IP.

I did not permit specific port in the first place and use service IP for the meantime to allow all service.

Please help me.

Thanks

[Marius Gunnerud]

I could be a problem with the routing of the public IP...but that is very unlikely.

in the ASDM realtime log viewer do you see any drops or asynchronous NAT...

--

Please remember to select a correct answer and rate helpful posts

[drlbaluyut]

No async nat on viewer when pinging 8.8.8.8 from dmz host. But i can see the permit hit count increase on dmz access rules permit any any. Also. On the real time viewer, teardown icmp can be seen and no drop. It worked one day then the next morning it became intermittent up to not working at all.

[Marius Gunnerud]

I suggest setting up a packet capture between the interfaces for the specific server

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110117-asa-capture-asdm-config.html

And see if you see traffic flow in both directions.

--

Please remember to select a correct answer and rate helpful posts

[drlbaluyut]

Hi

It is working again now. It cannot work when I set a specific TCP port 4343 in access-list for outside going in. After I changed to IP it worked. But I wonder why it cannot work after permitting only specific ports.

[Samer R. Saleem]

Hi,

1.check the inspection list on firewall

2. if it is working on [ IP ] check the ports that is in listening on both ends to see which port is in use and then check if its permitted on your firewall or not.

try capture traffic between the two hosts on firewall and analyze the traffic.

HTH

Samer.

[drlbaluyut]

I also cannot telnet to the public-address