ASA 9.2 - DMZ to Inside Communication

[mfdarvesh]

May be this question is asked many times, however, I am unable to find answer

LAN: 192.168.2.x 

DZM: 10.1.1.x

DMZ host 10.1.1.50 need to access LAN host 192.168.2.75

I am able to access DMZ from Inside LAN without any problem. What configuration is required for DMZ to access LAN. 

Thank you ..

[Rob Ingram]

Without seeing your configuration we can only guess.

Depending the security level of your DMZ and INSIDE interfaces, by default access from a lower level to a higher level is denied. You would need to permit traffic in an ACL

Also you'd need may need to check NAT and if necessary create a NAT exemption rule.

[mfdarvesh]

It is solved with following:

access-list dmz-inside permit tcp object dmz-subnet object db-server eq 1433

access-group dmz-inside in interface dmz

Now the question is how may I sure that this traffic is excluded from NAT ??

[Rob Ingram]

Good to hear