Thanks, for your response.  Can you explain?  Can you detail from the cfg what you think looks wrong.  Again, thanks

Can you post the output of sh logg as I am not sure about the translation you are doing there.

Sorry I did not see that static previously.

At a 1st look it should work with the config you have , but please do a sh logg when you try a telnet from outside to the webserver.

Thanks,

Vlad

You don't really need the global (dmz) statement, and you need an access-list for the dmz that will allow web traffic in from the outside - without one you have an implicit 'deny-all' rule on the dmz interface for anthing except traffic coming from the inside interface (traffic is always permited from a higher security interface to a lower security interface unless specifically excluded). Make another acl, say, acl_dmz, and allow the same traffic that you're allowing on your outside interface: acl_dmz extended permit tcp any host webserver eq 80 access-group acl_dmz in dmz

HTH, Paul

Thats why I asked the logging.

I was curious of the transaltion group for that DMZ.

Vlad

Hi,

Sorry to jump in the middle but I doubt the follow conf.

access-list acl_out extended permit tcp any host webserver eq www

access-group acl_out in interface outside

Instead of 'webserver' ,is it the outside IP address to be mentioned??? Becoz

names

name 192.168.100.2 webserver

It is a private IP address in the names list. More over We can specifically direct the traffic to port 80

static (dmz,outside) tcp interface 80 webserver 80 netmask 255.255.255.255

Regards

Jithesh

Jithesh,

you right!

The public ip should be mentioned there!

Regards,

Vlad

Shawn,

did you try what Jithesh says?

Allowing the public IP of the web server in the outside ACL?

Regards,

Vlad