cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
797
Views
0
Helpful
2
Replies

Problem accessing webservers on inside network

bha
Level 1
Level 1

Hi there forums!

Got a problem accessing our webservers on the inside interface from other clients on the inside interface on our ASA 5505.

As in, they type in www.company.com in their browser, and it wont work.

However, if we use a PC on another outside network, it works just fine!

Logs are getting spammed with this:

2          Jul 06 2011          20:36:44          106016                                                  Deny IP spoof from (87.54.35.46) to 195.215.244.209 on interface outside

87.54.35.46 is the outside interface address of the ASA,195.215.244.209 is the outside address of the webserver.

I realize this must be a routing issue of some sort, but I'm not really tough on that subject :/

Here's the config:

Result of the command: "show run"

: Saved

:

ASA Version 8.2(1)

!

hostname ciscoasa

domain-name domain2.local

enable password **************** encrypted

passwd *************** encrypted

names

name 10.35.17.0 VPNpool

name 172.16.0.12 AGDKGate_172.16.0.12

name 10.35.19.201 AGDK-BHA2_10.35.19.201

name 10.35.19.3 AGME2K7_10.35.19.3

name 10.35.19.7 OpenVPN_10.35.19.7

name 172.16.0.16 AGISA_172.16.0.16

name 172.16.0.15 AGISA_172.16.0.15

name 172.16.0.19 AGISA_172.16.0.19

name 172.16.0.22 AGISA_172.16.0.22

name 172.16.0.23 AGISA_172.16.0.23

name 172.16.0.18 AGISA_172.16.0.18

name 172.16.0.20 AGISA_172.16.0.20

name 172.16.0.24 AGISA_172.16.0.24

name 10.35.19.47 AGAXSQL_10.35.19.47

name 10.35.19.19 AGBackup_10.35.19.19

name 10.35.19.17 AGCADServer_10.35.19.17

name 10.35.19.9 AGDomain_10.35.19.9

name 10.35.19.14 AGPortal_10.35.19.14

name 10.35.19.231 AGSQL_10.35.19.231

name 10.35.19.70 AGVmware_10.35.19.70

name 10.35.19.209 AGCitrixDK_10.35.19.209

name 10.10.1.0 LokalNet_AGAP_10.10.1.0

name 10.35.16.0 LokalNet_AGDK_10.35.16.0

name 192.168.151.0 LokalNet_AGUK_192.168.151.0

name 10.12.1.0 LokalNet_RTI_10.12.1.0

name 216.82.240.0 Mailscan1_216.82.240.0

name 67.219.240.0 Mailscan2_67.219.240.0

name 85.158.136.0 Mailscan3_85.158.136.0

name 95.131.104.0 Mailscan4_95.131.104.0

name 117.120.16.0 Mailscan5_117.120.16.0

name 193.109.254.0 Mailscan6_193.109.254.0

name 194.106.220.0 Mailscan7_194.106.220.0

name 195.245.230.0 Mailscan8_195.245.230.0

name 10.35.19.5 PortalSQL_10.35.19.5

name 58.185.54.114 VPNGateway_AGAP

name 62.49.47.42 VPNGateway_AGUK

name 209.74.13.157 VPNGateway_RTI

!

interface Vlan1

nameif inside

security-level 100

ip address 10.35.19.1 255.255.252.0

!

interface Vlan2

nameif outside

security-level 0

ip address 87.54.35.46 255.255.255.252

!

interface Vlan5

nameif dmz

security-level 50

ip address 172.16.0.1 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

switchport access vlan 5

!

ftp mode passive

clock timezone CEST 1

clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00

dns domain-lookup inside

dns domain-lookup outside

dns domain-lookup dmz

dns server-group DefaultDNS

name-server AGDomain_10.35.19.9

name-server AGME2K7_10.35.19.3

domain-name domain2.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group service RDP tcp

port-object eq 3389

object-group service Splashtop tcp

port-object eq 6783

port-object eq 6784

port-object eq 6785

object-group service DynamicWebFTP tcp

port-object eq 5000

object-group service DMZ_to_Citrix

service-object tcp eq 8080

service-object tcp eq citrix-ica

service-object tcp eq www

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group service DM_INLINE_TCP_2 tcp

port-object eq https

port-object eq ldaps

access-list outside_access_in extended permit tcp any host 195.215.244.209 eq ftp

access-list outside_access_in extended permit ip any any

access-list outside_access_in remark Ping, DNS

access-list outside_access_in remark www.agramkow.com

access-list outside_access_in extended permit tcp any host AGDKGate_172.16.0.12 eq www

access-list outside_access_in remark csg.agramkow.com

access-list outside_access_in extended permit tcp any host AGDKGate_172.16.0.12 eq https

access-list outside_access_in extended permit object-group TCPUDP any any eq domain

access-list outside_access_in remark FTP til DynamicWeb support

access-list outside_access_in extended permit tcp any host AGDKGate_172.16.0.12 object-group DynamicWebFTP

access-list outside_access_in remark partner.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.16 eq https

access-list outside_access_in remark mobil.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.15 eq https

access-list outside_access_in remark webmail.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.19 eq https

access-list outside_access_in remark gemini.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.22 eq https

access-list outside_access_in remark ycam.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.23 eq www

access-list outside_access_in remark reports.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.18 eq https

access-list outside_access_in remark agnitio.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.20 eq https

access-list outside_access_in remark vip.agramkow.com

access-list outside_access_in extended permit tcp any host AGISA_172.16.0.24 eq https

access-list outside_access_in remark vpn.agramkow.com

access-list outside_access_in extended permit tcp any host OpenVPN_10.35.19.7 eq https

access-list outside_access_in extended permit tcp any host AGME2K7_10.35.19.3 eq smtp

access-list outside_access_in remark RDP til AGDK-BHA2

access-list outside_access_in extended permit tcp any host AGDK-BHA2_10.35.19.201 object-group RDP

access-list outside_access_in remark Splashtop til AGDK-BHA2

access-list outside_access_in extended permit tcp any host AGDK-BHA2_10.35.19.201 object-group Splashtop

access-list AGDK standard permit LokalNet_AGDK_10.35.16.0 255.255.252.0

access-list inside_nat0_outbound extended permit ip any VPNpool 255.255.255.0

access-list inside_nat0_outbound extended permit ip any LokalNet_AGAP_10.10.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip any 172.16.0.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip any LokalNet_AGUK_192.168.151.0 255.255.255.0

access-list outside_cryptomap extended permit ip LokalNet_AGDK_10.35.16.0 255.255.252.0 LokalNet_AGAP_10.10.1.0 255.255.255.0

access-list dmz_access_in extended permit tcp host AGISA_172.16.0.15 any eq www

access-list dmz_access_in extended permit tcp host AGISA_172.16.0.15 host AGME2K7_10.35.19.3 object-group DM_INLINE_TCP_2

access-list dmz_access_in extended permit icmp 172.16.0.0 255.255.255.0 any echo-reply

access-list dmz_access_in extended permit udp 172.16.0.0 255.255.255.0 any eq domain

access-list dmz_access_in extended permit object-group DMZ_to_Citrix host AGDKGate_172.16.0.12 host AGCitrixDK_10.35.19.209

access-list dmz_access_in extended permit ip any any

access-list outside_cryptomap_1 extended permit ip LokalNet_AGDK_10.35.16.0 255.255.255.0 LokalNet_AGUK_192.168.151.0 255.255.255.0

access-list inside_access_in extended permit ip any any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool VPNpool 10.35.17.100-10.35.17.125 mask 255.255.252.0

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-621.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

static (dmz,outside) tcp 195.215.244.209 www AGDKGate_172.16.0.12 www netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.209 smtp AGME2K7_10.35.19.3 smtp netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.209 https AGDKGate_172.16.0.12 https netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.210 https OpenVPN_10.35.19.7 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.209 5000 AGDKGate_172.16.0.12 5000 netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.212 https AGISA_172.16.0.15 https netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.222 3389 AGDK-BHA2_10.35.19.201 3389 netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.222 6783 AGDK-BHA2_10.35.19.201 6783 netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.222 6784 AGDK-BHA2_10.35.19.201 6784 netmask 255.255.255.255

static (inside,outside) tcp 195.215.244.222 6785 AGDK-BHA2_10.35.19.201 6785 netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.211 https AGISA_172.16.0.16 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.215 https AGISA_172.16.0.18 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.213 https AGISA_172.16.0.19 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.216 https AGISA_172.16.0.20 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.214 https AGISA_172.16.0.22 https netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.214 www AGISA_172.16.0.23 www netmask 255.255.255.255

static (dmz,outside) tcp 195.215.244.217 https AGISA_172.16.0.24 https netmask 255.255.255.255

static (dmz,outside) 195.215.244.209 AGDKGate_172.16.0.12 netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

access-group dmz_access_in in interface dmz

route outside 0.0.0.0 0.0.0.0 87.54.35.45 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http LokalNet_AGDK_10.35.16.0 255.255.252.0 inside

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map2 1 match address outside_cryptomap

crypto map outside_map2 1 set pfs group1

crypto map outside_map2 1 set peer VPNGateway_AGAP

crypto map outside_map2 1 set transform-set ESP-3DES-MD5 ESP-DES-MD5 ESP-3DES-SHA ESP-DES-SHA

crypto map outside_map2 2 match address outside_cryptomap_1

crypto map outside_map2 2 set pfs group1

crypto map outside_map2 2 set peer VPNGateway_AGUK

crypto map outside_map2 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map2 2 set phase1-mode aggressive group1

crypto map outside_map2 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map2 interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

subject-name CN=ciscoasa

crl configure

crypto isakmp identity key-id AGDK

crypto isakmp enable outside

crypto isakmp policy 5

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 1

lifetime 86400

no vpn-addr-assign aaa

no vpn-addr-assign dhcp

telnet timeout 5

ssh LokalNet_AGDK_10.35.16.0 255.255.252.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl encryption aes256-sha1 aes128-sha1 rc4-sha1

webvpn

enable inside

enable outside

svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

svc enable

group-policy DfltGrpPolicy attributes

dns-server value 10.35.19.9

vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value AGDK

default-domain value domain2.local

address-pools value VPNpool

username admin password tDYV7S6YQPO3cvLK encrypted

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

peer-id-validate nocheck

tunnel-group DefaultRAGroup general-attributes

authentication-server-group AGDK

tunnel-group DefaultRAGroup ipsec-attributes

pre-shared-key *

tunnel-group DefaultWEBVPNGroup general-attributes

address-pool VPNpool

authentication-server-group AGDK

tunnel-group DefaultWEBVPNGroup webvpn-attributes

group-alias AGDK enable

tunnel-group DefaultWEBVPNGroup ipsec-attributes

pre-shared-key *

tunnel-group VPNGateway_AGAP type ipsec-l2l

tunnel-group VPNGateway_AGAP ipsec-attributes

pre-shared-key *

peer-id-validate nocheck

tunnel-group VPNGateway_AGUK type ipsec-l2l

tunnel-group VPNGateway_AGUK ipsec-attributes

pre-shared-key *

peer-id-validate nocheck

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:e4147ad8b37e823b15b5801f4076d78f

: end

2 Replies 2

Hi,

   You get a Public IP address(195.215.244.209) from the DNS server when you want to connect 172.16.0.12(www) from Local LAN. Right? If so,please try this for testing.

For: Accessing from outside-to-DMZ

ciscoasa(conf)#access-list outside_access_in extended permit tcp any host 195.215.244.209 eq www

For: Modifing DNS reply when accessing webserver from local lan

ciscoasa(conf)#static (dmz,outside) 195.215.244.209 AGDKGate_172.16.0.12 netmask 255.255.255.255 dns

HTH,

Toshi

I figured it out, solved it by routing the traffic for the webservers comming from the inside network to the DMZ, bypassing the outside network. No clue if this is the proper way of doing it, but it works