Routing DMZ <-> INSIDE

[Stephan-Wild]

Hey together,

I have a little problem creating a network infrastucture with an "inside", "dmz" and an "outside" network on my ASA5512-x 8.6(1).

I have have clients and servers with the networks 10.0.1.0/24, 10.0.2.0/24 until 10.0.12.0/24 on my inside interface. Then I have two servers 10.0.254.50/24 for SMTP and 10.0.254.70/24 for HTTPS in my dmz network. The outside interface is one static IP to the Internet.

I configured the interfaces with the security-levels 0 (outside), 50 (dmz) and 100 (inside).

There are object-groups for the inside networks, an object for inside_mail_server,dmz_mail_server and the same for the webservers and objects for the PAT services.

The nat configuration at the time is very simple (the nat exemption for l2l vpn and RA vpn are not in the following listing). I do a forwarding from outside to dmz

  nat (outside,dmz) source static any any destination static interface dmz_web_server service pat_https pat_https

  nat (outside,dmz) source static any any destination static interface dmz_mail_server service pat_smtp pat_smtp

  nat (inside,outside) source dynamic inside_net interface

  nat (dmz,outside) source dynamic dmz_net interface

The access list for the forwarding is:

  access-list outside_access_in extended permit tcp any any eq https

  access-list outside_access_in extended permit tcp any any eq smtp

  access-group outside_access_in in interface outside

This works very fine but now I want to allow access from the dmz-servers to inside-servers. I tried an access-list "permit tcp host dmz_web_server host inside_web_server eq https" and I bound it to "in interface dmz"

I cannot access the dmz servers from my inside network and from dmz to inside.

If it is possible, I don't want to use translation between inside and dmz.

Thanks a lot

Stephan

[Jouni Forss · Accepted solution]

Hi,

By default the newer softwares dont require any NAT configurations from you for the traffic between your own private networks if you dont specifically need/want a NAT for the traffic.

I would personally suggest a different NAT to accomplish the above mentioned configuration

I'll give examples below

Configuration Static PAT / Port Forwarding

object network DMZ-HTTPS

host 10.10.20.10

nat (dmz,outside) static interface service tcp 443 443

object network DMZ-SMTP

host 10.10.20.20

nat (dmz,outside) static interface service tcp 25 25

Where

• 10.10.20.10 and 10.10.20.20 = Example IP addresses
• "dmz" and "outside" = example interface names

Default PAT for both LAN and DMZ

object-group DEFAULT-PAT-SOURCE

network-object 10.10.10.0 255.255.255.0

network-object 10.10.20.0 255.255.255.0

nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

nat (dmz,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

Where

• DEFAULT-PAT-SOURCE = Defines the source addresses for the PAT translations
• "after-auto" = Moves the Default PAT rules to the Section 3 of the ASAs NAT rules
  • They will be matched the last if no other Section 1 and Section 2 rule match them
  • Section 1 = Twice NAT and Section 2 = Object NAT

There is a slight chance that the NAT0 type configuration might be also messing with the LAN - DMZ traffic.

Generally I would avoid using "any" either as defining the "source"/"destination" address or the interfaces in the NAT configurations. They can cause problems with traffic passing through the ASA because they can match traffic they arent supposed to.

Please rate if the information was helpfull and/or ask more questions if needed

- Jouni

[Stephan-Wild]

Hi Jouni,

I reconfigured my test ASA with the following:

: Saved

: Written by enable_15 at 15:04:40.849 UTC Wed Jan 16 2013

!

ASA Version 8.6(1)

!

hostname ciscoasa

names

!

interface Ethernet0/0

nameif outside

security-level 0

ip address 1.1.1.170 255.255.255.248

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Ethernet0/2

nameif dmz

security-level 50

ip address 10.0.254.1 255.255.255.0

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

object network DMZ-HTTPS

host 10.0.254.70

object network DMZ-SMTP

host 10.0.254.50

object-group network INSIDE_NETWORKS

network-object 10.0.1.0 255.255.255.0

network-object 10.0.2.0 255.255.255.0

network-object 10.0.3.0 255.255.255.0

network-object 10.0.4.0 255.255.255.0

network-object 10.0.5.0 255.255.255.0

object-group network DMZ_NETWORKS

network-object 10.0.254.0 255.255.255.0

object-group network DEFAULT_PAT_SOURCE

group-object INSIDE_NETWORKS

group-object DMZ_NETWORKS

access-list outside_access_in extended permit tcp any any eq https

access-list outside_access_in extended permit tcp any any eq smtp

access-list outside_access_in extended permit tcp any any eq www

access-list dmz_inside extended permit tcp host 10.0.254.50 host 10.0.1.50 eq smtp

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq www

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq https

access-list dmz_inside extended permit ip object-group INSIDE_NETWORKS object-group DMZ_NETWORKS

!

icmp permit any outside

icmp permit any inside

icmp permit any dmz

!

object network DMZ-HTTPS

nat (dmz,outside) static interface service tcp www www

object network DMZ-SMTP

nat (dmz,outside) static interface service tcp smtp smtp

!

nat (inside,outside) after-auto source dynamic DEFAULT_PAT_SOURCE interface

nat (dmz,outside) after-auto source dynamic DEFAULT_PAT_SOURCE interface

access-group outside_access_in in interface outside

access-group dmz_inside in interface dmz

route outside 0.0.0.0 0.0.0.0 1.1.1.169 1

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

I changed the https to www for testing. I can access from inside, dmz to outside from outside to dmz from inside to dmz but not from dmz to inside. What is my fault?

Stephan

[Jouni Forss]

Hi,

The configuration seems fine to me for the most part.

What I did notice that you have configured your INSIDE networks as the source and DMZ as the destination in your "dmz" ACL. I presume you were meaning to configure it the other way around?

Maybe the traffic is getting blocked by the ACL still?

You can try the following command to confirm what the ASA does to your traffic (even though I can see your configuration but I cant be sure on the source and destination IP address you are using for tests)

packet-tracer input dmz tcp

Use the command with the correct IPs and Ports you want and copy/paste the output from CLI to here

- Jouni

[Stephan-Wild]

Hi,

I thought i have to add the last line of the dmz_inside acl to allow the reverse traffic from inside ip addresses to dmz addresses.

Here is the output of the packet-tracer:

ciscoasa# packet-tracer input dmz tcp 10.0.254.70 55555 10.0.1.70 80

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

MAC Access list

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   10.0.1.0        255.255.255.0   inside

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group dmz_inside in interface dmz

access-list dmz_inside extended permit tcp host 10.0.254.70 host 10.0.1.70 eq www

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 1, packet dispatched to next module

Result:

input-interface: dmz

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

It seems to be fine but I cannot open a website from 10.0.254.70 on 10.0.1.70.

Stephan

[Jouni Forss]

Hi,

Everything seems to be fine regarding the firewall on the basis of that output atleast.

Have you check the firewall logs through ASDM or the CLI when you are attempting the actual HTTP connection between the 2 hosts?

The logging level would need to be atleast "informational"

logging asdm informational

or

logging buffered informational

And you would be looking for log messages starting with "Built outbound/inbound TCP connection" and "Teardown TCP connection"

If the Teardown message reason is SYN Timeout the inside host is not responding to the connection forming attempt.

- Jouni

[Stephan-Wild]

Hi Jouni,

I'm so sorry. After a long time configuring a firewall and servers...

I had an error in my inside webserver ip address. Everything is working fine.

Thank you very very much.

Sorry again for my mistake.

[Jouni Forss]

Hi,

No problem Stephan. Main thing is that its working now

- Jouni