1. i am not able to ping from out side to DMZ nat ip.

2. no

3. Yes

Hi,

- From outside did you ping the ip address of the firewall's interface outside?

- From host in DMZ did you have access to hosts in Internet?

First of all your access-list is wrong:

access-list DMZ1_access_in extended permit ip host 1.1.27.113 any

access-list DMZ1_access_in extended permit icmp host 1.1.27.113 any

The 1.1.27.113 will never be seen on the DMZ side, it will only see the pre-nat local IP.

Secondly one of your static's is incorrect:

static (inside,outside) 1.1.27.101 192.168.5.101 netmask 255.255.255.255

This should be 192.168.1.101 OR

static (DMZ1,outside) 1.1.27.101 192.168.5.101 netmask 255.255.255.255

Thirdly, why have you put two default routes?

Regards

Hi,

thanks a lot, i will implement the config as you said n try to ping from outside.

Regards.

all global ip are responding from out side, except DMZ NAT IP.

Thank you Farrukh, it is working now. I think the only problem was ACL_DMZ and that is what it was not comming out of the FW.

Hi,

Just do some logging and icmp debugging in ASA then post it here.

did u try a telnet to a server.

Regards

Omair the issue is with the ACL and the static.

Regards

Farrukh

Agreed but I hope that he changed the config.