It works now! I can access the TOS_Host.  Thank you so much for helping solve the issue.  ... View more

That's why I didn't see the ACLs in GUI. I run the command and I can see the ACLs in ASDM GUI now.  ... View more

Hi, Here you go:  Result of the command: "sh runn" : Saved : : Serial Number: XXXXXXXXXXX : Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores) : ASA Version 9.4(2) ! hostname ASA-5506-ASA domain-name XXXXXXXXXXXXXXXXXXX enable password XXXXXXXXXX names ip local pool VPN_Pool 1xx.xx.xx-1xx.xx.xx.xx mask 255.xxx.xxx.0 ! interface GigabitEthernet1/1 description To Verizon WAN nameif outside security-level 0 ip address XXX.XX.XXX.XX XXX.XXX.XXX.2XX ! interface GigabitEthernet1/2 description Inside Network nameif inside security-level 100 ip address XXXXXXXXXXXXXXXXXXXXXXXXXX ! interface GigabitEthernet1/2.30 description Guest_Wifi_Vlan vlan 30 nameif GuestWIFI security-level 40 ip address 192.168.18.1 255.255.255.0 ! interface GigabitEthernet1/3 description To Comcast WAN nameif COMCAST security-level 0 ip address XXXXXXXXXXXXXXXXXXXXXXXXXX ! interface GigabitEthernet1/4 description DMZ Interface nameif DMZ security-level 50 ip address XXXXXXXXXXXXXXXXXXXXXXXXXX ! interface GigabitEthernet1/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/6 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/7 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/8 shutdown no nameif no security-level no ip address ! interface Management1/1 management-only no nameif no security-level no ip address ! boot system disk0:/XXXXX.SPA ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns domain-lookup inside dns domain-lookup COMCAST dns domain-lookup DMZ dns server-group DefaultDNS name-server XXXXXXXXXXXXXXXXXXX domain-name XXXXXXXXXXXXXXXXXXX same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet XXXXXXXXXXXXXXXXXXX object network NETWORK_OBJ_XXXXXXXXXXXXXXXXXXX subnet XXXXXXXXXXXXXXXXXXX object network CUCM-6970 host XXXXXXXXXXXXXXXXXXX object network CUCM-69 host XXXXXXXXXXXXXXXXXXX object network DMZ-Subnet subnet XXXXXXXXXXXXXXXXXXX object-group service ICMP_ALLOWED service-object icmp echo service-object icmp echo-reply service-object icmp unreachable service-object icmp time-exceeded object-group network INSIDE_SUBNET network-object XXXXXXXXXXXXXXXXXXX object-group network TOS_HOST network-object host XXXXXXXXXXXXXXXXXXX object-group network GuestWiFi_SUBNET network-object 192.168.18.0 255.255.255.0 access-list SplitTunnel standard permit XXXXXXXXXXXXXXXXXXX access-list SplitTunnel standard permit XXXXXXXXXXXXXXXXXXX access-list SplitTunnel standard permit XXXXXXXXXXXXXXXXXXX access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_1 access-list AnyConnect_Client_Local_Print extended deny ip any4 any4 access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631 access-list AnyConnect_Client_Local_Print remark Windows' printing port access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100 access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol access-list AnyConnect_Client_Local_Print extended permit udp any4 host XXXXXXXXXXXXXXXXXXX eq 5353 access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol access-list AnyConnect_Client_Local_Print extended permit udp any4 host XXXXXXXXXXXXXXXXXXX eq 5355 access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137 access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns access-list GuestWIFI_access_in extended permit ip object-group GuestWiFi_SUBNET object-group TOS_HOST access-list GuestWIFI_access_in extended deny ip object-group GuestWiFi_SUBNET object-group INSIDE_SUBNET access-list GuestWIFI_access_in extended deny ip object-group GuestWiFi_SUBNET any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 mtu GuestWIFI 1500 mtu COMCAST 1500 mtu DMZ 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/XXXXXXXXXXXXXXXXXXX.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,outside) source static any any destination static NETWORK_OBJ_XXXXXXXXXXXXXXXXXXX NETWORK_OBJ_XXXXXXXXXXXXXXXXXXX no-proxy-arp route-lookup ! object network CUCM-6970 nat (inside,outside) static interface service tcp 6970 6970 object network CUCM-69 nat (inside,outside) static interface service udp tftp tftp object network DMZ-Subnet nat (DMZ,COMCAST) dynamic interface nat (inside,COMCAST) after-auto source dynamic any interface nat (inside,outside) after-auto source dynamic any interface nat (GuestWIFI,COMCAST) after-auto source dynamic any interface access-group outside_access_in in interface outside access-group COMCAST_access_in in interface COMCAST route COMCAST XXXXXXXXXXXXXXXXXXX route outside XXXXXXXXXXXXXXXXXXX route inside XXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXX ldap attribute-map LDAP_memberOf map-name memberOf Group-Policy map-value memberOf CN=XXXXXXXXXXXXXXXXXXX,OU=Groups,DC=XXX,DC=XXXX TEST aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host XXXXXXXXXXXXXXXXXXX key ***** radius-common-pw XXXXXXXXXXXXXXXXXXX aaa-server LDAP_Domain protocol ldap aaa-server LDAP_Domain (inside) host XXXXXXXXXXXXXXXXXXX ldap-base-dn DC=XXX,DC=XXXX ldap-scope subtree ldap-naming-attribute sAMAccountName ldap-login-password ***** ldap-login-dn CN=XXXXXXXXXXXXXXXX,OU=XXXXXXXXXXXXXXX,DC=XXX,DC=XXXXX server-type microsoft ldap-attribute-map LDAP_memberOf user-identity default-domain LOCAL aaa authentication enable console LOCAL aaa authentication http console LOCAL aaa authentication ssh console LOCAL http server enable http XXXXXXXXXXXXXXXXXXX inside http XXXXXXXXXXXXXXXXXXX inside http XXXXXXXXXXXXXXXXXXX outside http XXXXXXXXXXXXXXXXXXX outside snmp-server host inside XXXXXXXXXXXXXXXXXXX community ***** snmp-server host inside XXXXXXXXXXXXXXXXXXX community ***** snmp-server host inside XXXXXXXXXXXXXXXXXXX poll community ***** version 2c no snmp-server location no snmp-server contact service sw-reset-button dhcpd auto_config outside ! dhcpd address 192.168.18.2-192.168.18.254 GuestWIFI dhcpd dns 8.8.8.8 8.8.4.4 interface GuestWIFI dhcpd option 3 ip 192.168.18.1 interface GuestWIFI dhcpd option 6 ip 8.8.8.8 8.8.4.4 interface GuestWIFI dhcpd enable GuestWIFI ! threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list no threat-detection statistics tcp-intercept ntp server 192.5.41.40 source outside : end ... View more

Hi, I added the ACLs below, I still can't access the TOS_Host and I can't ping it either.  ... View more

After adding that, I lost internet connectivity on the Guest Network. Before, I was able to ping the TOS Host by enabling ICMP via the GUI.  ... View more

No, except the any to any less secure networks implicit rule. Also, there is a global implicit rule that denies any any IP ... View more

Hi,  Thank you so much for the fast reply. I added the 3 access rules. The computer when connected to the guest WIFI network still cannot access the TOS host. As soon as the computer connects to the guest wifi, it opens the web browser and redirects to 172.xx.xx.xx:8843/guest/... and then I get "The Page cannot be displayed" ... View more

I get an error when I run the commands below, any idea?  access-list extended GuestWIFI_access_in permit tcp object-group GuestWiFi_SUBNET object-group TOS_HOST eq  8843 access-list extended GuestWIFI_access_in deny ip object-group GuestWiFi_SUBNET object-group INSIDE_SUBNET access-list extended GuestWIFI_access_in deny ip object-group GuestWiFi_SUBNET any ... View more

Hi,  The subnet for the inside network is 172.xx.xx.x/23 The subnet for the Guest WIFI network is 192.168.18.0/24 The CLI output is below:  Result of the command: "show runn access-group" access-group outside_access_in in interface outside access-group GuestWIFI_access_in in interface GuestWIFI access-group COMCAST_access_in in interface COMCAST You can ignore the outside interface for now.  ... View more

Hi, Thank you so much for your response. This might be a noob question, but every time I add an access-list it overrides the access-list that allows traffic from any to any less secure network. The questions what is the command or GUI element to add that access-list back?  ... View more

Dear Rick,  I am sorry for the late reply. I found some more information that will help us narrow down the issue. By default, in the guest interface, there is an Implicit rule created on the ASA that will allow traffic from any source to any destination with a less secure network, see the image below. When I create the ACL to allow traffic destined for port 8843 it overrides the Implicit rule, and therefore nothing works. How do I preserve the implicit rule (or turn it into an explicit rule) and add an extra rule to allow traffic destined to port 8843? Does it make sense?  ... View more

Hi Rick,  I created the ACL on the guest vlan interface. Below you will find some more details.  When people connect to my guest network, the ASA issues an address of 192.168.18.x to the host. Then a browser page opens up that will redirect them to guestservices.domain.com:8843. That is where they will accept the TOS, and then they will be redirected to our website domain.com.  I created an ACL on the guest interface, and the info is below:  Source: GuestWifiNetwork/24  Destination: Guest Captive Portal (A network object that holds the IP of the server hosting the guest portal) this server is connected to my internal network.  Service: https, 8443, and 8843.  I enabled ICMP, and it works just fine. But for some reason, it still can't connect to guestservices.domain.com:8843.  Any suggestions?  ... View more

I created a host network object called "guest_portal" and give the internal IP address of the server where the portal software is installed. I then created an ACL on the Comcast interface to allow "any" packets to the host network object that has the service tcp /https.  ... View more

Hi Rick, Back with another quick question. Now that I have setup the Guest_Wifi vlan and the access to the internet is working I want the guests to access a sperate portal and accept the TOS before getting to the web. The unifi controller creates a very nice UI that users are redirected to for TOS acceptance, and I would like to use that. The problem I am running into is that the portal is on my corporate network and user connecting to the guest wifi cannot access the portal (obviously, since the guest vlan is on a lower security level than the corporate network). I figured this would be solved by creating an ACL and allowing https traffic to access the server running the portal. I did create the ACL, but the I still can't reach the portal when I am on the guest network. Any Suggestions?  ... View more