Created DMZ

[Nhut]

Hello everyone, please help me. I want to create 3 sections: INSIDE, OUTSIDE and DMZ. With OUTSIDE it is possible to ping, and access services in the DMZ. INSIDE also does the same thing and it has the addition of being able to ping OUTSIDE(8.8.8.8), only INSIDE can ping OUTSIDE, not the reverse (OUTSIDE cannot ping INSIDE), I used the following methods: rules like 

access-list DMZ-ACCESS extended permit icmp any any

access-list DMZ-ACCESS extended permit tcp any any eq www

access-list DMZ-ACCESS extended permit tcp any any eq 8080

access-list DMZ-ACCESS extended permit tcp any any eq domain

access-list DMZ-ACCESS extended permit udp any any eq domain

access-list DMZ-ACCESS extended permit udp any any eq bootps

access-list DMZ-ACCESS extended permit udp any any eq bootpc

access-list INTERNET-ACCESS extended permit icmp any any

access-list INTERNET-ACCESS extended permit tcp any any eq domain

access-list INTERNET-ACCESS extended permit udp any any eq domain

access-list INTERNET-ACCESS extended permit tcp any any eq www

access-list INTERNET-ACCESS extended permit tcp any any eq 8080

access-list INTERNET-ACCESS extended permit tcp any any

access-list IN-DMZ extended permit tcp any any

access-list IN-DMZ extended permit udp any any

access-group DMZ-ACCESS in interface DMZ

access-group IN-DMZ out interface INSIDE

access-group INTERNET-ACCESS in interface OUTSIDE 

I have applied the above rules but web access to DMZ is not possible. And what I don't want is for OUTSIDE to be able to access INSIDE. So please help me everyone 

[Nhut]

I don't know how to match the in and out of an INSIDE, OUTSIDE or DMZ interface

[Flavio Miranda]

Usually ACL is placed as closer as the source as possible. For example, if you want to deny one PC to access the internet, you can add the ACL on the INSIDE interface and on the out direction.

If you want to deny a host on the internet to access something inside your network, you can place the ACL on the OUTSIDE interface and on the IN direction.

Imagine yourself inside the firewall.  Do you want to avoid the traffic to get inside the firewall (OUSIDE/in) or avoid the traffic to leave the firewall (OUTSIDE OUT)

use the same idea for others interface

[Nhut]

How can I delete that password? Thank you

[Flavio Miranda]

You can change but I dont believe you can remove it with command.

What you can do is copy the running-config  and save it in a txt file. Then, you can erase the firewall configuration with

ASA#write erase

Erase configuration in flash memory? [confirm]

After that, copy the the config again to the firewall, without the enable password