Accesss List Question

axiollc · ‎08-02-2017

Client is in need of using his other interfaces as DMZs. We found that ping and smb were allowed from the DMZ2, and I'm fairly certain this is because Global Rules are used with any any for a given network, even though there are interface specific access rules; it's simply ignoring for the global:

access-list global_access extended permit ip 192.168.0.0 255.255.255.0 any

and

access-list global_access extended permit ip 192.168.2.0 255.255.255.0 any

LAN is 192.168.0.0 and DMZ2 is 192.168.2.0

Just confirming that we can just change the global access lists above from ANY to the WAN interface to allow traffic outbound for those rules, and the other global access lists below, to allow an internal network (LAN, or any DMZ) to traverse outbound to the internet. Maybe it's better we drop all these global access lists and only use Interface specific access lists.

Finally, it seems we need to remove the "same-security-traffic permit intra-interface" command to prevent the DMZs at sec level 50 from passing traffic between as well. While we can make each DMZ different sec levels, higher levels would still have access to the lower, and they simply do not want any interface of LAN or DMZ to be able to access each other unless explicitly allowed with an access list, or obviously there is no DMZ.

Your input and help is greatly appreciated.

PS ASA5515x doesn't allow for DHCP reservations? Haven't checked command line yet, but ASDM gui doesn't offer.

Config follows:

ASA Version 8.6(1)2
!
hostname somehostname
domain-name domain.local
enable password encrypted
passwd encrypted
names
!
interface GigabitEthernet0/0
nameif WAN
security-level 0
ip address w1.w1.124.34 255.255.255.252
!
interface GigabitEthernet0/1
nameif LAN
security-level 100
ip address 192.168.0.253 255.255.255.0
!
interface GigabitEthernet0/2
nameif DMZ2
security-level 50
ip address 192.168.2.1 255.255.255.0
!
interface GigabitEthernet0/3
nameif DMZ3
security-level 50
ip address 192.168.3.1 255.255.255.0
!
interface GigabitEthernet0/4
nameif DMZ4
security-level 50
ip address 192.168.4.1 255.255.255.0
!
interface GigabitEthernet0/5
nameif DMZ5
security-level 50
ip address 192.168.254.1 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa861-2-smp-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup WAN
dns domain-lookup LAN
dns domain-lookup DMZ2
dns domain-lookup DMZ5
dns domain-lookup management
dns server-group DefaultDNS
name-server ns1.ns1.ns1.ns1
name-server ns2.ns2.ns2.ns2
domain-name domain.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network gwava_smtp
host 192.168.0.252
object network gwava_123
host 192.168.0.252
object network gwava_ssh
host 192.168.0.252
object network sanderling_https
host 192.168.0.241
object service gwavaRAS
service tcp destination eq 49282
object service sandRAS
service tcp destination eq 6523
object network gwava_ras
host 192.168.0.252
object network sanderling_ras
host 192.168.0.241
object service SSLvpn
service tcp destination eq 6666
object network NETWORK_OBJ_192.168.168.0_26
subnet 192.168.168.0 255.255.255.192
object network NETWORK_OBJ_192.168.0.0_24
subnet 192.168.0.0 255.255.255.0
object network sanderling_https_nat
host 192.168.0.241
object network RSAPort5500
host 192.168.0.254
description RSA
object network RSAport7004
host 192.168.0.254
description RSA
object network RSAport7072
host 192.168.0.254
description RSA
object network WAN
host w1.w1.124.34
object network RSAServer
host 192.168.0.254
object service 7004
service tcp source eq 7004
object network RSAport7004_1
host 192.168.0.254
object network LANVPN_Network
subnet 192.168.168.0 255.255.255.0
description VPN Clients
object network Merganser
host 192.168.0.240
description Merganser DNS
object network musconetcong
host 192.168.0.235
description RDS RDWeb
object network ISP_STATIC_1
host w2.w2.244.241
object network LAN_HOST_1
host 192.168.0.241
object network ISP_STATIC_2
host w3.w3.244.242
object-group network BLOCKLIST
network-object host b1.b1.b1.b1
network-object host b2.b2.b2.b2
object-group service RDP tcp
description Remote Desktop
port-object eq 3389
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group network HTTPS_Hosts_via_VPN
description OWA and RDWeb
network-object object musconetcong
network-object object sanderling_https
access-list WAN_access_in_1 extended permit udp any host 192.168.0.254 eq 5500
access-list WAN_access_in_1 extended permit tcp any host 192.168.0.254 eq 7072
access-list WAN_access_in_1 extended permit tcp any host 192.168.0.254 eq 7004
access-list WAN_access_in_1 extended permit tcp any object gwava_smtp eq smtp
access-list WAN_access_in_1 extended permit udp any object gwava_123 eq ntp
access-list WAN_access_in_1 extended permit tcp any object gwava_ssh eq ssh inactive
access-list WAN_access_in_1 extended permit tcp any object sanderling_https eq https
access-list WAN_access_in_1 extended permit tcp any object gwava_ras eq 49282 inactive
access-list WAN_access_in_1 extended permit object SSLvpn any any
access-list WAN_access_in_1 extended deny ip object-group BLOCKLIST any
access-list VPN_Tunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list global_access extended permit tcp 192.168.0.0 255.255.255.0 any eq www
access-list global_access extended permit ip 192.168.0.0 255.255.255.0 any
access-list global_access extended permit object-group TCPUDP object Merganser any eq domain
access-list global_access extended permit tcp object LANVPN_Network 192.168.0.0 255.255.255.0 object-group RDP
access-list global_access extended permit object-group TCPUDP object LANVPN_Network 192.168.0.0 255.255.255.0 eq domain
access-list global_access remark allow access to RDS RDWeb
access-list global_access extended permit tcp object LANVPN_Network object-group HTTPS_Hosts_via_VPN eq https
access-list global_access extended permit ip 192.168.2.0 255.255.255.0 any
access-list global_access extended permit tcp 192.168.2.0 255.255.255.0 any eq domain
access-list global_access extended permit ip 192.168.254.0 255.255.255.0 any
access-list global_access extended permit object-group TCPUDP 192.168.254.0 255.255.255.0 any eq domain
access-list global_access extended permit ip 192.168.3.0 255.255.255.0 any
access-list global_access extended permit object-group TCPUDP 192.168.3.0 255.255.255.0 any eq domain
access-list DMZ2_access_out extended permit ip any any
access-list DMZ2_access_out extended permit tcp any any eq www
access-list DMZ2_access_out extended permit tcp any any eq domain
access-list DMZ3_access_out extended permit ip any any
access-list DMZ3_access_out extended permit tcp any any eq www
access-list DMZ3_access_out extended permit object-group TCPUDP any any eq domain
pager lines 24
logging enable
logging buffer-size 20000
logging buffered debugging
logging asdm informational
mtu WAN 1500
mtu LAN 1500
mtu DMZ2 1500
mtu DMZ5 1500
mtu management 1500
mtu DMZ3 1500
mtu DMZ4 1500
ip local pool VPN_POOL 192.168.168.1-192.168.168.50 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-66114.bin
no asdm history enable
arp timeout 14400
nat (LAN,WAN) source static RSAport7004_1 interface service 7004 7004
nat (LAN,WAN) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_192.168.168.0_26 NETWORK_OBJ_192.168.168.0_26
!
object network gwava_smtp
nat (LAN,WAN) static interface service tcp smtp smtp
object network gwava_123
nat (LAN,WAN) static interface service udp ntp ntp
object network gwava_ssh
nat (LAN,WAN) static interface service tcp ssh ssh
object network gwava_ras
nat (LAN,WAN) static interface service tcp 49282 49282
object network NETWORK_OBJ_192.168.168.0_26
nat (WAN,WAN) dynamic interface
object network sanderling_https_nat
nat (LAN,WAN) static interface service tcp https https
object network RSAPort5500
nat (LAN,WAN) static interface service udp 5500 5500
object network RSAport7072
nat (LAN,WAN) static interface service tcp 7072 7072
object network LAN_HOST_1
nat (LAN,WAN) static ISP_STATIC_1 service tcp 3389 3389
!
nat (LAN,WAN) after-auto source dynamic any interface
nat (DMZ2,WAN) after-auto source dynamic any interface
nat (DMZ3,WAN) after-auto source dynamic any ISP_STATIC_2
nat (DMZ5,WAN) after-auto source dynamic any interface
access-group WAN_access_in_1 in interface WAN
access-group DMZ2_access_out out interface DMZ2
access-group DMZ3_access_out out interface DMZ3
access-group global_access global
route WAN 0.0.0.0 0.0.0.0 w1.w1.124.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server RSA_Group protocol radius
aaa-server RSA_Group (LAN) host 192.168.0.254
key *****
radius-common-pw *****
no mschapv2-capable
user-identity default-domain LOCAL
http server enable 4443
http 192.168.0.0 255.255.255.0 LAN
http 0.0.0.0 0.0.0.0 LAN
http 0.0.0.0 0.0.0.0 WAN
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
no sysopt connection permit-vpn
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map WAN_map interface WAN
crypto map LAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map LAN_map interface LAN
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=somename
ip-address w1.w1.124.34
crl configure
crypto ca trustpoint ASDM_TrustPoint1
crl configure
crypto ca trustpoint ASDM_TrustPoint2
keypair ASDM_TrustPoint2
crl configure
crypto ca trustpoint ASDM_TrustPoint2-1
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate bba8a458
quit
crypto ca certificate chain ASDM_TrustPoint2
certificate ca 03eda3eb6eca75c888438b724bcfbc91
quit
certificate 56072c9e13a41991cf66ec21cd5567c0
quit
crypto ca certificate chain ASDM_TrustPoint2-1
certificate ca 064ee056904246b1a1756ac95991c74a
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable WAN client-services port 4043
crypto ikev2 enable LAN client-services port 4043
crypto ikev2 remote-access trustpoint ASDM_TrustPoint2
crypto ikev1 enable WAN
crypto ikev1 enable LAN
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet 0.0.0.0 0.0.0.0 LAN
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 LAN
ssh timeout 5
console timeout 0
management-access LAN
dhcpd address 192.168.0.100-192.168.0.149 LAN
dhcpd dns 192.168.0.240 interface LAN
dhcpd domain domain.internal interface LAN
dhcpd enable LAN
!
dhcpd address 192.168.2.50-192.168.2.99 DMZ2
dhcpd dns ns1.ns1.ns1.ns1 ns2.ns2.ns2.ns2 interface DMZ2
dhcpd enable DMZ2
!
dhcpd address 192.168.254.50-192.168.254.99 DMZ5
dhcpd dns ns1.ns1.ns1.ns1 ns2.ns2.ns2.ns2 interface DMZ5
dhcpd enable DMZ5
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
dhcpd address 192.168.3.50-192.168.3.99 DMZ3
dhcpd dns ns1.ns1.ns1.ns1 ns2.ns2.ns2.ns2 interface DMZ3
dhcpd enable DMZ3
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp authenticate
ntp server 192.168.0.240 source LAN prefer
ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 des-sha1
ssl trust-point ASDM_TrustPoint2 WAN
ssl trust-point ASDM_TrustPoint2 LAN
webvpn
port 6666
enable WAN
enable LAN
dtls port 4043
anyconnect image disk0:/anyconnect-win-4.4.01054-webdeploy-k9.pkg 1
anyconnect image disk0:/anyconnect-macos-4.4.01054-webdeploy-k9.pkg 2
anyconnect profiles Default_client_profile disk0:/Default_client_profile.xml
anyconnect enable
tunnel-group-list enable
tunnel-group-preference group-url
group-policy VPN_Tunnel internal
group-policy VPN_Tunnel attributes
wins-server none
dns-server value 192.168.0.240 ns1.ns1.ns1.ns1
vpn-idle-timeout 90
vpn-session-timeout 420
vpn-tunnel-protocol ikev1 ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_Tunnel_splitTunnelAcl
default-domain value domain.internal
group-policy DfltGrpPolicy attributes
banner value You are connected.
vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
group-policy GroupPolicy_Default internal
group-policy GroupPolicy_Default attributes
wins-server none
dns-server value 192.168.0.240 ns1.ns1.ns1.ns1
vpn-tunnel-protocol ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_Tunnel_splitTunnelAcl
default-domain value domain.internal
webvpn
anyconnect profiles value Default_client_profile type user
tunnel-group VPN_Tunnel type remote-access
tunnel-group VPN_Tunnel general-attributes
address-pool VPN_POOL
authentication-server-group RSA_Group LOCAL
default-group-policy VPN_Tunnel
tunnel-group VPN_Tunnel ipsec-attributes
ikev1 pre-shared-key ********************
tunnel-group Default type remote-access
tunnel-group Default general-attributes
address-pool VPN_POOL
authentication-server-group RSA_Group
default-group-policy VPN_Tunnel
tunnel-group Default webvpn-attributes
group-alias Default enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:fefe992ed11ea5f192f887b7924a8f4b
: end