Re: Publishing Website with ASA5510

psycedelic77 · ‎02-15-2010

Hi Guys, we are installing a new web server in our environment. Current web server is on Windows 2003 x64 R2 with IIS6.0 . The default www page is abled to view internally but not externally.

We used ASDM to configure the NAT and open ports 21,80,8080. unfortunately, looks like http dont seem to be working. only ftp works. I

s it mandatory for us to configure DMZ for the web server? As now we are doing NAT and opening ports just like our other servers

I used to be using ISA and that we need to publish www in the configuration. Does ASA requires to do this or are there any steps required to publish www?

FW has not been rebooted for the past 4 months. I doubt rebooting helps. or does it?

ASA5510 , ASDM6.1(3) ASA Version 8.0

Appreciate your reply. Thanks!

Psycedelic77

JORGE RODRIGUEZ · ‎02-15-2010

Rebooting the firewall is not a good way to troubleshooting issues, you could however clear server connections by issuing asa#clear local-host in firewall command line.. sort of clearing the xlate for this host. You need to first look at your firewall configuration by double checking the config pertaining to the newly installed server nat translations, inbound access rules , ASDM realtime log is another great tool to visually see what is happening while outside host tries to access the server on these two other ports etc.. You have mentioned port 21 - ftp works, so it seems your ftp inbound rule is working , check the inbound access-list for the remining ports, that is tcp port 80 and 8080 by going to asa command line and issue show access-list | inc and look at hit counts on the acl ., look at your ASDM real time log and from the outside have someone access the server and observe logs to see any drops etc..

You may also post firewall configuration relevant to nat statements mappings to this server and access-list for us to have a second look.

Is it mandatory for us to configure DMZ for the web server? As now we are doing NAT and opening ports just like our other servers

It is not mandatory to have your public servers on DMZs , however , security design guidelines recomends to house your Public Accessible Web servers segregated from your private internal network.

I used to be using ISA and that we need to publish www in the configuration. Does ASA requires to do this or are there any steps required to publish www?

Nothing special to do in asa for forwarding web traffic to a internal private/public web server, other than maping local host to a public IP address and access rules as seen in bellow link. http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080862017.shtml

[edit]

Forgot to mention, if your firewall inbound access rules are correct for tcp port 80 and 8080 check the server tcpip settings ensuring proper mask and default gateway.

Regards

Jorge Rodriguez

psycedelic77 · ‎02-15-2010

Hi Jorge,

Thanks for the prompt reply.

I forgot to mentioned that there is already an existing web server in our LAN. This is will be another web server. Been hunting forum threads and came across http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_23696094.html which is similar to the current situation i'm in.

Can't we have two web servers in a single interface? Am not certain that this could be the problem of trying to configure 2 webservers in a single interface .Below is the configuration for reference. We have to add on the following servers in the configuration

Web Server

WAN xx.xx.65.135

LAN xx.xx. 8.88

to open

21,5888 (already working)

80,8080,8081 (all http ports - not working)

MySql Server (after sorting out the web server)

WAN xx.xx.65.150

LAN xx.xx.8.94

to open

21, 5888, 80, 3306

Appreciate your comment and advise. Thank you in advance.

_____________________________________________-

ASA Version 8.0(4)
!
hostname FW01
enable password M8D6MT9GhqGKeW0W encrypted
passwd Vkn0u8N1DjcP5VFm encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address xx.xx.65.130 255.255.255.224
ospf cost 10
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 172.30.8.1 255.255.255.0
ospf cost 10
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
ospf cost 10
management-only
!
ftp mode passive
clock timezone SGT 8
object-group network DM_INLINE_NETWORK_2
network-object host xx.xx.19.50
network-object host xx.xx.19.55
object-group network DM_INLINE_NETWORK_4
network-object host xx.xx.65.136
network-object host xx.xx.65.142
network-object host xx.xx.65.141
network-object host xx.xx.65.140
network-object host xx.xx.65.150
object-group network DM_INLINE_NETWORK_6
network-object host xx.xx.65.136
network-object host xx.xx.65.142
network-object host xx.xx.65.140
object-group network DM_INLINE_NETWORK_7
network-object host xx.xx.19.58
network-object host xx.xx.19.59
object-group network DM_INLINE_NETWORK_8
network-object host xx.xx.31.10
network-object host xx.xx.40.87
network-object host xx.xx.40.88
network-object host xx.xx.41.91
network-object host xx.xx.140.2
object-group service DM_INLINE_SERVICE_1
service-object icmp
service-object tcp eq 10050
service-object tcp eq 5888
service-object tcp eq 1433
object-group service DM_INLINE_TCP_2 tcp
port-object eq www
port-object eq https
object-group service DM_INLINE_TCP_4 tcp
port-object eq ftp
port-object eq ftp-data
object-group service DM_INLINE_SERVICE_2
service-object icmp
service-object tcp eq 9746
service-object tcp eq ftp
service-object tcp eq ftp-data
service-object tcp eq 5888
object-group service VNC tcp
port-object eq 5888
object-group service DM_INLINE_TCP_3 tcp
port-object eq www
port-object eq https
object-group network Group_Joker
network-object host xx.xx.12.97
network-object host xx.xx.12.98
object-group network Group_SeQueL
network-object host xx.xx.19.50
network-object host xx.xx.19.55
group-object Group_Joker
object-group service SQL tcp
port-object eq 1433
object-group network Group_Admin
description Administrator
network-object host xx.xx.19.55
network-object host xx.xx.19.50
object-group network Group_HQ
description Local Office
network-object xx.xx.19.48 255.255.255.240
object-group network DM_INLINE_NETWORK_1
group-object Group_Joker
group-object Group_HQ
object-group network DM_INLINE_NETWORK_9
network-object host xx.xx.65.141
network-object host xx.xx.65.142
object-group service DM_INLINE_TCP_5 tcp
group-object VNC
port-object eq 5888
port-object eq ftp
object-group network DM_INLINE_NETWORK_5
network-object host xx.xx.65.136
network-object host xx.xx.65.141
network-object host xx.xx.65.142
network-object host xx.xx.65.140
network-object host xx.xx.65.150
object-group network Deny-IPs
description Beelie website deny access rule
network-object host xx.xx.140.2
network-object host xx.xx.135.199
object-group network RealVNC-Access
description Real VNC Access for Support
network-object host xx.xx.19.50
network-object host xx.xx.140.2
object-group service RealVNC tcp
description VNC-Support Access
port-object eq 5900
object-group network DM_INLINE_NETWORK_10
network-object host xx.xx.65.135
network-object host xx.xx.65.142
network-object host xx.xx.65.140
object-group network DM_INLINE_NETWORK_12
network-object host xx.xx.65.135
network-object host xx.xx.65.140
object-group network DM_INLINE_NETWORK_14
group-object Group_Joker
group-object Group_SeQueL
object-group service DM_INLINE_TCP_6 tcp
group-object RealVNC
port-object eq 5888
object-group service SQLUDP udp
description SQL
port-object eq 1434
object-group service MYSQL tcp
description MYSQL Port
port-object eq 3306
object-group network DM_INLINE_NETWORK_16
network-object host xx.xx.65.135
network-object host xx.xx.65.150
object-group service DM_INLINE_SERVICE_4
service-object icmp
service-object icmp echo
service-object icmp echo-reply
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service DM_INLINE_TCP_1 tcp
port-object eq 8081
port-object eq ftp
port-object eq ftp-data
port-object eq www
port-object eq https
object-group service DM_INLINE_TCP_7 tcp
port-object eq ftp
port-object eq ftp-data
port-object eq 5888
port-object eq 8081
port-object eq www
port-object eq 8080
access-list outside_access_in extended permit object-group TCPUDP any host xx.xx.65.135 eq www inactive
access-list outside_access_in remark Beelie
access-list outside_access_in extended permit tcp any host xx.xx.65.142 object-group DM_INLINE_TCP_1
access-list outside_access_in remark Charlie
access-list outside_access_in extended permit tcp any host xx.xx.65.141 object-group DM_INLINE_TCP_3
access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_12 eq 1433 inactive
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object-group Group_Admin object-group DM_INLINE_NETWORK_4
access-list outside_access_in remark Staging Server
access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 host xx.xx.65.136 object-group DM_INLINE_TCP_2
access-list outside_access_in remark Graphics Designer Access
access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 object-group DM_INLINE_NETWORK_9 object-group DM_INLINE_TCP_4 inactive
access-list outside_access_in extended permit icmp object-group DM_INLINE_NETWORK_8 host xx.xx.65.140
access-list outside_access_in remark Access via SQL Manager
access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_14 host xx.xx.65.140 object-group SQL
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group Group_Joker object-group DM_INLINE_NETWORK_6
access-list outside_access_in remark VNC to 135 for Support
access-list outside_access_in extended permit tcp host xx.xx.140.2 object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_TCP_5
access-list outside_access_in extended permit tcp object-group Group_Joker host xx.xx.65.136 object-group SQL
access-list outside_access_in extended permit tcp object-group RealVNC-Access object-group DM_INLINE_NETWORK_10 object-group RealVNC inactive
access-list outside_access_in extended permit tcp host xx.xx.140.2 host xx.xx.65.142 object-group DM_INLINE_TCP_6 inactive
access-list outside_access_in remark SQL Browser Service
access-list outside_access_in extended permit udp any host xx.xx.65.150 object-group SQLUDP inactive
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any object-group DM_INLINE_NETWORK_16 inactive
access-list outside_access_in extended permit tcp any host xx.xx.65.135 object-group DM_INLINE_TCP_7
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit tcp any any eq 5888
access-list inside_access_in extended permit object-group TCPUDP host 172.30.8.88 any eq www
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0
static (inside,outside) xx.xx.65.142 172.30.8.91 netmask 255.255.255.255
static (inside,outside) xx.xx.65.141 172.30.8.90 netmask 255.255.255.255
static (inside,outside) xx.xx.65.136 172.30.8.89 netmask 255.255.255.255
static (inside,outside) xx.xx.65.135 172.30.8.88 netmask 255.255.255.255
static (inside,outside) xx.xx.65.140 172.30.8.93 netmask 255.255.255.255
static (inside,outside) xx.xx.65.150 172.30.8.94 netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.65.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http xx.xx.xx.114 255.255.255.255 outside
http 192.168.1.0 255.255.255.0 management
http 172.30.8.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 172.30.8.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:46ff756a6d3a63dca9c65488ce7d8198
: end

JORGE RODRIGUEZ · ‎02-15-2010

Hi Thanks for posting the config, briefly looked at it seems straight forward and fine , will have another look again , in mean time could you post the output of the server in question tcpip configuration e.i c:\ipconfig /all .

Rrgds

Jorge Rodriguez

psycedelic77 · ‎02-15-2010

Hi,

Below is the ipconfig /all

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : HP NC373i Multifunction
apter #2
   Physical Address. . . . . . . . . : 00-1C-C4-A9-2F-12
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 172.30.8.88
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.8.1
   DNS Servers . . . . . . . . . . . : 202.148.161.44
                                       202.136.31.2

route print results

Active Routes:
Network Destination        Netmask          Gateway       Interface Metric
          0.0.0.0          0.0.0.0       172.30.8.1      172.30.8.88     10
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
       172.30.8.0    255.255.255.0      172.30.8.88      172.30.8.88     10
      172.30.8.88 255.255.255.255        127.0.0.1        127.0.0.1     10
   172.30.255.255 255.255.255.255      172.30.8.88      172.30.8.88     10
        224.0.0.0        240.0.0.0      172.30.8.88      172.30.8.88     10
255.255.255.255 255.255.255.255      172.30.8.88      172.30.8.88      1
Default Gateway:        172.30.8.1
===========================================================================
Persistent Routes:
None

Thank you.

Kureli Sankar · ‎02-16-2010

Firewall config appears correct. With the object groups it was hard to make sure permission was there.

host 172.30.8.88 config looks correct as well.

Make sure this host is listening on all the ports that it is supposed to.

If you open a browser on this same computer and go to http://172.30.8.88:8080 and http://172.30.8.88:8081 and other ports does it load the page?

If you do the same from another 172.30.8.x computer does that load the pages? Let us make sure it works locally before we look at the firewall.

When accessed from the outside what do the logs show?

conf t

loggin enable

loggin buffered 7

exit

sh logg | i 172.30.8.88

when the access fails. Let us know what you see.

-KS

psycedelic77 · ‎02-16-2010

Hi Kusankar,

Thank you for the tips. Let me do these steps and i will get back to you.

With regards to 172.30.8.88 (this is the IP for our web server)

About the object groups, the rule for the new web server is excluded. We did a fresh new rule manually pointing directly to the ports required, not creating any oblject rules for us to be able to troubleshoot easier.

Any further thoughts appreciated. Thank you.