Hello,
I am having issues creating a DMZ on a test asa. As soon as I apply the below command it kills the outbound internet connection but I can still connect to the ASA enternally via SSH and I can also ping the external IP. Could anyone shed any light on it for me?
As soon as I add the below it dies..
!
interface Ethernet0/1
switchport access vlan 3
!
Config is below.
ASA Version 8.4(4)1
!
hostname TEST-ASA
enable password Password
passwd Password
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.168 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group BTI
ip address 81.xx.xx.xx 255.255.255.255 pppoe setroute
!
interface Vlan3
nameif dmz
security-level 10
ip address 172.16.1.168 255.255.0.0
!
boot system disk0:/asa844-1-k8.bin
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network Inside-NAT
subnet 192.168.0.0 255.255.255.0
object network inside-net
subnet 192.168.0.0 255.255.255.0
object network dmz-net
subnet 172.16.0.0 255.255.0.0
access-list incoming-outside extended permit icmp any any echo
access-list incoming-outside extended permit icmp any any echo-reply
access-list dmz_out extended permit ip any any
access-list dmz_access_in extended permit icmp 172.16.0.0 255.255.255.0 192.168.0.0 255.255.255.0 echo-reply
access-list dmz_access_in extended deny ip 172.16.0.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list dmz_access_in extended permit ip 172.16.0.0 255.255.255.0 any
access-list dmz_access_in extended permit icmp 172.16.0.0 255.255.255.0 any
access-list dmz_access_in extended permit icmp 172.16.0.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list dmz_access_in extended permit icmp any any
access-list dmz_access_in extended permit tcp host 172.16.1.140 host 192.168.0.xxx
access-list dmz-out extended permit ip host 172.16.1.xxx any
access-list dmz-out extended permit tcp host 172.16.1.xxx host 192.168.0.xxx
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any interface outside eq www
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
object network Inside-NAT
nat (inside,outside) dynamic interface
object network dmz-net
nat (dmz,outside) dynamic interface
access-group outside_in in interface outside
access-group dmz_out in interface dmz
access-group dmz_out out interface dmz
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 0:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
lifetime 43200
telnet timeout 5
ssh 192.168.0.0 255.255.255.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group BTI request dialout pppoe
vpdn group BTI localname Username@BT.com
vpdn group BTI ppp authentication chap
vpdn username Username@BT.com Password password01 store-local
dhcpd auto_config outside
!
dhcpd address 192.168.0.210-192.168.0.240 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
