Solved: ServerASA5505 ASA ver 8.4(4) 1 ASDM Version 6.4(5)

HUPERT BUTZ PASNO · ‎07-03-2015

hi guys,

I got this asa5505 to configure for our network i just cant figure out whats wrong with my current configuration to allow outside network to access a webserver behind a dmz...Fallowed several tutorials but nothing works for me :(, Anyone here can help me...? thanks a lot in advance

ASA5505 ASA ver 8.4(4) 1 ASDM Version 6.4(5)

inside 10.0.0.1/8

outside: 172.22.13.15/16

dmz: 172.16.0.1/16

any help would be much appreciated thank you :)

*****************************************

object network dmz-subnet
subnet 172.16.0.0 255.255.0.0
nat (dmz,outside) dynamic interface
exit

object network dmz-host-ext
host 172.22.13.15
exit

object network dmz-host-int
host 172.16.0.2
nat (dmz,outside) static dmz-host-ext
exit

access-list inbound extended permit tcp any object dmz-host-int eq www
access-list inbound extended permit tcp any object dmz-host-int eq https
access-group inbound in interface outside

access-list dmz-outbound permit tcp object dmz-host-int host 10.0.0.100 eq 1433
access-group dmz-outbound in interface dmz

Marvin Rhoads · ‎07-29-2015

You don't need (and should remove):

nat (dmz,outside) static dmz-host-ext

access-list dmz-outbound permit tcp object dmz-host-int host 10.0.0.100 eq 1433
access-group dmz-outbound in interface dmz

The "nat(outside,dmz) static dmz-host-ext" is the only host NAT you need.

The access-list should not be used as it is not necessary from DMZ to outside (assuming you've assigned the DMZ a higher security level that the outside).

View solution in original post

Marvin Rhoads · ‎07-04-2015

You should use a dedicated address (apart from the outside interface address) for your DMZ server's static NAT.

You then need a nat (outside,dmz) for that object.

Your access-list is fine (one you fix the nat).

HUPERT BUTZ PASNO · ‎07-07-2015

Thank you Sir... for your reply i will try it now... changing my configuration... hope it work well :)

HUPERT BUTZ PASNO · ‎07-29-2015

Sir Marvin can you spare me some time to check my configuration still i cannot access the webserver behind the dmz. Thank you.

I have made some changes. Sorry i'm new at ASA

ASA5505 ASA ver 8.4(4) 1 ASDM Version 6.4(5)

inside 10.0.0.1/8
outside: 172.22.13.15/16
dmz: 172.16.0.1/16
webserverexternalip- 172.22.13.14
*****************************************