well this magically popped up again today. have no idea why. the http sever is not running on the device. The show config proves its not running. I can't figure out why this thing is blocking https from our 1 server. The server is in the access list specifically with
access-list 102 extended permit tcp any host 192.168.200.200 eq https
access-list 102 extended permit udp any host 192.168.200.200 eq 443
There are other permits in there as well. There are not any deny entries.... Can anyone think of a reason why this would be?
Here is the latest running config...
ASA Version 7.2(4)
!
hostname CiscoASA
domain-name ****[redacted]****.com
enable password ****[redacted]**** encrypted
passwd ****[redacted]**** encrypted
names
!
interface Vlan1
description Behind Firewall
nameif inside
security-level 100
ip address 192.168.200.254 255.255.255.0
!
interface Vlan2
description Outside Firewall - Ethernet 0/0 is R20 - Ethernet 0/2 is Outsid
e - Ethernet 0/3 is Atlantic Zeiser
nameif outside
security-level 0
ip address 204.186.233.26 255.255.255.252
!
interface Vlan3
nameif Presses
security-level 50
ip address 192.168.100.254 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 3
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 2
duplex full
!
interface Ethernet0/3
switchport access vlan 2
!
interface Ethernet0/4
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa724-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name ****[redacted]****.com
same-security-traffic permit intra-interface
access-list 101 extended permit ip host 204.186.124.2 10.1.1.0 255.255.255.0
access-list 101 extended permit ip 192.168.200.0 255.255.255.0 10.1.1.0 255.255.
255.0
access-list 101 extended permit ip any 10.1.1.0 255.255.255.0
access-list 102 extended permit ip any host 204.186.124.115
access-list 102 extended permit tcp any host 204.186.124.2 eq smtp
access-list 102 extended permit tcp any host 204.186.124.2 eq pop3
access-list 102 extended permit tcp any host 204.186.124.2 eq www
access-list 102 extended permit icmp any any echo-reply
access-list 102 extended permit tcp any host 204.186.124.113 eq www
access-list 102 extended permit tcp any host 204.186.124.114 eq www
access-list 102 extended permit tcp any host 204.186.124.114 eq 3011
access-list 102 extended permit tcp any host 204.186.124.113 eq 3011
access-list 102 extended permit udp any host 204.186.124.113 eq 3011
access-list 102 extended permit udp any host 204.186.124.114 eq 3011
access-list 102 extended permit tcp any host 192.168.200.200 eq www
access-list 102 extended permit udp any host 192.168.200.200 eq www
access-list 102 extended permit tcp any host 192.168.200.200 eq https
access-list 102 extended permit udp any host 192.168.200.200 eq 443
access-list 102 extended permit tcp any host 192.168.200.200 eq 500
access-list 102 extended permit udp any host 192.168.200.200 eq isakmp
access-list 102 extended permit tcp any host 192.168.200.200 eq 4500
access-list 102 extended permit udp any host 192.168.200.200 eq 4500
access-list 102 extended permit tcp any host 204.186.124.2 eq 587
access-list inside_access_in remark Facebook
access-list inside_access_in extended deny tcp any 69.63.176.0 255.255.240.0
access-list inside_access_in remark My space
access-list inside_access_in extended deny tcp any 216.178.32.0 255.255.240.0
access-list inside_access_in extended permit ip any any
access-list presses_in extended permit ip any any
access-list presses_in extended permit icmp any any
access-list cap extended permit tcp host 192.168.200.200 any eq https
access-list cap extended permit tcp host 192.168.200.200 any eq www
pager lines 24
logging enable
logging timestamp
logging monitor debugging
logging trap debugging
logging history debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu Presses 1500
ip local pool clients 10.1.1.1-10.1.1.254
ip verify reverse-path interface outside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
asdm location 216.178.32.0 255.255.240.0 inside
asdm history enable
arp timeout 14400
nat-control
global (outside) 1 204.186.124.4-204.186.124.110 netmask 255.255.255.0
global (outside) 1 204.186.124.3 netmask 255.255.255.0
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0
nat (outside) 1 10.1.1.0 255.255.255.0
nat (Presses) 1 0.0.0.0 0.0.0.0
static (inside,outside) 204.186.124.2 192.168.200.202 netmask 255.255.255.255
static (inside,outside) 204.186.124.113 192.168.200.235 netmask 255.255.255.255
static (inside,outside) 204.186.124.114 192.168.200.236 netmask 255.255.255.255
static (Presses,outside) 204.186.124.115 192.168.100.253 netmask 255.255.255.255
static (inside,Presses) 192.168.200.201 192.168.200.201 netmask 255.255.255.255
static (inside,outside) 204.186.124.208 192.168.200.208 netmask 255.255.255.255
static (inside,outside) 204.186.124.209 192.168.200.209 netmask 255.255.255.255
static (inside,outside) 204.186.124.210 192.168.200.210 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group 102 in interface outside
access-group presses_in in interface Presses
route outside 0.0.0.0 0.0.0.0 204.186.233.25 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http 192.168.200.0 255.255.255.0 inside
http 192.168.200.254 255.255.255.255 inside
http 192.168.200.0 255.255.255.255 inside
http 192.168.1.2 255.255.255.255 inside
http 192.168.1.0 255.255.255.0 inside
http 192.168.200.40 255.255.255.255 inside
no snmp-server location
no snmp-server contact
sysopt connection tcpmss 1300
sysopt noproxyarp inside
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map dynmap 20 set transform-set myset
crypto dynamic-map dynmap 40 set pfs
crypto dynamic-map dynmap 40 set transform-set ESP-3DES-SHA
crypto map mymap 20 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
telnet timeout 30
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
ssh version 1
console timeout 0
group-policy vpnweb internal
group-policy vpnweb attributes
dns-server value 192.168.200.201 192.168.200.202
vpn-tunnel-protocol IPSec
default-domain value ****[redacted]****.local
group-policy vpn3000 internal
group-policy vpn3000 attributes
banner value Welcome to ****[redacted]**** Virtual Private Network
dns-server value 192.168.200.201 192.168.200.203
vpn-idle-timeout 30
default-domain value ****[redacted]****.local
tunnel-group vpn3000 type ipsec-ra
tunnel-group vpn3000 general-attributes
address-pool clients
default-group-policy vpn3000
tunnel-group vpn3000 ipsec-attributes
pre-shared-key *
isakmp ikev1-user-authentication none
tunnel-group vpnweb type ipsec-ra
tunnel-group vpnweb general-attributes
address-pool clients
default-group-policy vpnweb
tunnel-group vpnweb ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:****[redacted]****
