Help getting DMZ access from outside

metuckness · ‎09-21-2016

Hi,

I have an ASA5510 that I have been training myself on to get more experience with CISCO IOS and I am having an issue routing traffic from outside to the DMZ (which is actually just a second network, I haven't actually created a DMZ yet).

So I have an interface called Outside, Inside, DMZ, VOIP.

I can muddle my way through to allowing certain traffic from the Outside to the Inside, but for some reason I cannot grant traffic from the Outside to the interface I have labeled as DMZ.

I was hoping someone could take a look at my config and tell me what I have wrong in regards to allowing traffic from the Outside interface to access resources on the DMZ interface like I can allow to the Inside interface. I am going to work on restricting access for the DMZ, but right now it is at level 100 just like the inside. Eventually I want to move all the accessed things to the DMZ and configure it properly, but right now just trying to learn the other stuff.

I want to enable and allow WWW and SSH (on a different port) to a device on the DMZ at 128.162.1.25

: Saved
:
ASA Version 9.1(4)
!
hostname ASA5510
domain-name
enable password liqhNWIOSfzvir2g encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd liqhNWIOSfzvir2g encrypted
names
dns-guard
!
interface Ethernet0/0
description LAN Interface
nameif Inside
security-level 100
ip address 10.10.1.1 255.255.255.252
!
interface Ethernet0/1
description WAN Interface
nameif Outside
security-level 0
ip address 255.255.255.128
!
interface Ethernet0/2
description DMZ
nameif DMZ
security-level 100
ip address 10.10.0.1 255.255.255.252
!
interface Ethernet0/3
description VOIP
nameif VOIP
security-level 100
ip address 10.10.2.1 255.255.255.252
!
interface Management0/0
management-only
shutdown
nameif management
security-level 0
no ip address
!
boot system disk0:/asa914-k8.bin
ftp mode passive
clock timezone MST -7
clock summer-time MDT recurring
dns domain-lookup Inside
dns domain-lookup Outside
dns server-group DefaultDNS
name-server 8.8.8.8
name-server 8.8.4.4
name-server
name-server
domain-name
same-security-traffic permit inter-interface
object network ROUTER-2811
host 10.10.1.2
object network ROUTER-2821
host 10.10.0.2
object network DNS-SERVER
host 192.168.1.2
object network ROUTER-3745
host 10.10.2.2
object network RDP-DC1
host 192.168.1.2
object network BLUE
host 192.168.1.6
description Blue Iris Server
object network RBPI-SSH
host 192.168.1.15
description Raspberry Pi
object network RBPI-WWW
host 192.168.1.15
description Raspberry Pi Web Server
object network RBPI-VPN
host 192.168.1.15
description OPENVPN
object network RBPI-FTP
host 192.168.1.15
description Raspberry PI FTP
object network RBPI-DNS
host 192.168.1.15
object network RBPI-DNS-TCP
host 192.168.1.15
object network DVR
host 128.162.1.25
description DVR WWW
object network DVR-SSH
host 128.162.1.25
description Zoneminder DVR SSH
object network DMZ_outside
subnet 0.0.0.0 0.0.0.0
object-group network PAT-SOURCE
network-object 10.10.1.0 255.255.255.252
network-object 10.10.0.0 255.255.255.252
network-object 10.10.2.0 255.255.255.252
network-object 192.168.0.0 255.255.255.0
network-object 172.16.10.0 255.255.255.0
network-object 172.16.20.0 255.255.255.0
network-object 128.162.1.0 255.255.255.0
network-object 128.162.10.0 255.255.255.0
network-object 128.162.20.0 255.255.255.0
network-object 192.168.1.0 255.255.255.0
network-object 192.168.10.0 255.255.255.0
network-object 192.168.20.0 255.255.255.0
network-object 172.16.1.0 255.255.255.0
network-object 162.128.1.0 255.255.255.0
network-object 162.128.10.0 255.255.255.0
network-object 162.128.20.0 255.255.255.0
network-object 142.16.1.0 255.255.255.0
network-object 142.16.10.0 255.255.255.0
network-object 142.16.20.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
network-object host
object-group network Outside_access_in
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object gre
object-group network DM_INLINE_NETWORK_3
network-object host
object-group network DMZ_access_in
access-list USERS standard permit 10.10.1.0 255.255.255.0
access-list Outside_access_in extended permit tcp host ip object ROUTER-2811 eq
access-list Outside_access_in extended permit tcp host ip object ROUTER-2821 eq
access-list Outside_access_in extended permit tcp host ip object RDP-DC1 eq
access-list Outside_access_in extended permit tcp host ip object ROUTER-3745 eq
access-list Outside_access_in extended permit tcp any object BLUE eq
access-list Outside_access_in extended permit tcp host ip any eq
access-list Outside_access_in extended permit tcp host ip object RBPI-SSH eq
access-list Outside_access_in extended permit tcp any object RBPI-WWW eq
access-list Outside_access_in extended permit tcp any object RBPI-VPN eq
access-list Outside_access_in extended permit tcp host ip object RBPI-FTP eq
access-list Outside_access_in extended permit udp any object RBPI-DNS eq
access-list Outside_access_in extended permit tcp any object RBPI-DNS-TCP eq
access-list dmz-access-vlan1 extended permit ip 128.162.1.0 255.255.255.0 any
access-list dmz-access remark Permit all traffic to DC1
access-list dmz-access remark Permit only DNS traffic to DNS server
access-list dmz-access extended permit udp 128.162.1.0 255.255.255.0 host 192.168.1.2 eq domain
access-list dmz-access remark Permit ICMP to all devices in DC
access-list dmz-access extended permit icmp 128.162.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list dmz-access remark Permit all traffic to DC1
access-list dmz-access remark Permit only DNS traffic to DNS server
access-list dmz-access remark Permit ICMP to all devices in DC
access-list DMZ_access_in extended permit tcp any host 128.162.1.25 eq ssh
pager lines 24
logging enable
logging asdm informational
mtu Inside 1500
mtu Outside 1500
mtu DMZ 1500
mtu VOIP 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any Outside
asdm image disk0:/asdm-715.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network ROUTER-2811
nat (Inside,Outside) static interface service tcp
object network ROUTER-2821
nat (DMZ,Outside) static interface service tcp
object network ROUTER-3745
nat (VOIP,Outside) static interface service tcp
object network RDP-DC1
nat (Inside,Outside) static interface service tcp port
object network BLUE
nat (Inside,Outside) static interface service tcp port
object network RBPI-SSH
nat (Inside,Outside) static interface service tcp
object network RBPI-WWW
nat (Inside,Outside) static interface service tcp
object network RBPI-VPN
nat (Inside,Outside) static interface service tcp
object network RBPI-FTP
nat (Inside,Outside) static interface service tcp
object network RBPI-DNS
nat (Inside,Outside) static interface service udp
object network RBPI-DNS-TCP
nat (Inside,Outside) static interface service tcp
object network DVR-SSH
nat (DMZ,Outside) static interface service tcp
object network DMZ_outside
nat (DMZ,Outside) dynamic interface
!
nat (any,Outside) after-auto source dynamic any interface
route Outside 0.0.0.0 0.0.0.0 68.233.151.1 1
route DMZ 128.162.1.0 255.255.255.0 10.10.0.2 1
route DMZ 128.162.10.0 255.255.255.0 10.10.0.2 1
route DMZ 128.162.20.0 255.255.255.0 10.10.0.2 1
route VOIP 142.16.1.0 255.255.255.0 10.10.2.2 1
route VOIP 142.16.10.0 255.255.255.0 10.10.2.2 1
route VOIP 142.16.20.0 255.255.255.0 10.10.2.2 1
route Inside 172.16.10.0 255.255.255.0 10.10.1.2 1
route Inside 172.16.20.0 255.255.255.0 10.10.1.2 1
route Inside 192.168.1.0 255.255.255.0 10.10.1.2 1
route Inside 192.168.10.0 255.255.255.0 10.10.1.2 1
route Inside 192.168.20.0 255.255.255.0 10.10.1.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
no user-identity enable
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http 0.0.0.0 0.0.0.0 Inside
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Inside
ssh ip 255.255.255.255 Outside
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 24.56.178.140 source Outside prefer
username encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect pptp
inspect icmp
inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
password encryption aes
hpm topN enable
Cryptochecksum:271c8513ae692ccc7c17a18977a6892f
: end

Luke Oxley · ‎09-21-2016

metuckness,

Thanks for your post. Just for your information, Cisco IOS and Cisco ASA are two different sets of code. IOS is the system that sits on top of Cisco routers and switches whereas ASA sits on top of Cisco's security appliances.

Moving on, whilst I can see you've made a great start at writing the configuration, I have spotted a few issues. Starting off with the basics, you've created your access control lists but not actually applied them anywhere. In ASA, unless the access control list is applied to an interface or applied globally, it takes no effect at all. You should first look to apply your access control lists with the following command syntax to their respective interface.

access-group Outside_access_in in interface outside
access-group <define-acl-name> <define-direction-in/out> interface <define-interface-name>

I cannot see any major issues with NAT'ing between the DMZ and Outside interfaces at the moment, so lets just start with this for now. Make the amendments and let me know how you get along.

Kind regards,

Luke

Please rate helpful posts and mark correct answers.

metuckness · ‎09-22-2016

Oh, thanks for that clarification on the difference of platform terminologies, didn't realize that.

I guess applying the Access Group Outside_access_in to an interface would actually help :) some of those actually take place.

So I added that statement, I will see how it impacts as soon as I can. Right now I am at home so I can't access anything from an external IP. But I will be able to test the existing connections tomorrow (like if I can access the www site and ssh into switches remotely.

I did have this statement, but I don't think it was applied to anything:

object-group network Outside_access_in

metuckness · ‎09-23-2016

I guess I had not put that statement in. I just checked the config and it didn't have it (I must of deleted my old one and forgot to add the new one) so I just added it and they are back up and working!

So I guess I just had not had that ACL applied to an interface or I deleted part of it since they used to work and forgot, but my outside access to the Inside network is working properly again, so thanks!

Do you have any pointers how I can grant outside access to the DMZ? Since that still seems to allude me. Because I want to bring my outside resources over to the zone, and lock it down properly instead of treating it as another inside interface. Since right now all it has is security cameras.

metuckness · ‎09-23-2016

Disregard.