cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4457
Views
5
Helpful
22
Replies

ASA 5505 ver 8.4 DMZ to Outside not working

itmanager2
Level 1
Level 1

I have an ASA 5505 ver 8.4. The configuration is provided below. My INSIDE hosts are able to get to the internet via the Outside interface. The DHCP for my INSIDE hosts are handled by my L3 3560 switch. My DMZ hosts DHCP is handled by the ASA 5505. I've included packet-tracer results for both from the DMZ to the Outside address (DNS server) and a return packet tracer from the Outside interface to the DMZ host address. I see that the return is failing, however everything I have tried so far hasn't worked. Thank you in advance for any assistance.

***************************************8

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password (removed)

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

    3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

    05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

    6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

    2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

    33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

    6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

    616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

    86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

    b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

    fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

    6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

    1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

    551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

    03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

    0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

    092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

    5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

    ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

    1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

    0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

default-domain value moxiefl.com

webvpn

  anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f2c7362097b71bcada023c6bbfc45121

: end

************************************************************************************

Packet Tracer from DMZ to Outside

mxfw# packet-tracer input dmz icmp 172.26.20.22 8 0 208.67.222.222 detailed

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   0.0.0.0         0.0.0.0         outside

Phase: 2

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac5bdb90, priority=0, domain=inspect-ip-options, deny=true

        hits=22, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=dmz, output_ifc=any

Phase: 3

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xacff7ee0, priority=70, domain=inspect-icmp, deny=false

        hits=8, user_data=0xad253a68, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

        src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

        input_ifc=dmz, output_ifc=any

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac5bd768, priority=66, domain=inspect-icmp-error, deny=false

        hits=8, user_data=0xac5bcd80, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

        src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

        input_ifc=dmz, output_ifc=any

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (dmz,outside) source dynamic Generic_All_Network interface

Additional Information:

Dynamic translate 172.26.20.22/0 to 192.168.1.231/23136

Forward Flow based lookup yields rule:

in  id=0xac63c0e8, priority=6, domain=nat, deny=false

        hits=7, user_data=0xac6209f0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=dmz, output_ifc=outside

Phase: 6

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Reverse Flow based lookup yields rule:

in  id=0xac578bf0, priority=0, domain=inspect-ip-options, deny=true

        hits=7510, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 7

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 7561, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_icmp

snp_fp_translate

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_translate

snp_fp_inspect_icmp

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input-interface: dmz

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

***********************************************************************************

Packet Tracer for return from Outside:

mxfw(config)# packet-tracer input outside icmp 207.67.222.222 0 0 172.26.20.22$

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   172.26.20.0     255.255.255.0   dmz

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xacea45d8, priority=11, domain=permit, deny=true

        hits=0, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: dmz

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

***********************************************************************************

Settings of PC and PING & tracert results

C:\Users>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : MXW8DT01

   Primary Dns Suffix  . . . . . . . :

   Node Type . . . . . . . . . . . . : Hybrid

   IP Routing Enabled. . . . . . . . : No

   WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 11:

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter

   Physical Address. . . . . . . . . : 68-94-23-20-FA-C5

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Ralink RT5390R 802.11bgn Wi-Fi Adapter

   Physical Address. . . . . . . . . : 68-94-23-20-FA-C3

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Realtek PCIe FE Family Controller

   Physical Address. . . . . . . . . : 08-9E-01-3D-64-39

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   IPv4 Address. . . . . . . . . . . : 172.26.20.22(Preferred)

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Lease Obtained. . . . . . . . . . : Sunday, October 6, 2013 3:28:48 PM

   Lease Expires . . . . . . . . . . : Sunday, October 6, 2013 4:28:48 PM

   Default Gateway . . . . . . . . . : 172.26.20.1

   DHCP Server . . . . . . . . . . . : 172.26.20.1

   DNS Servers . . . . . . . . . . . : 208.67.222.222

                                       208.67.220.220

   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{9B004C7D-7A34-4A9C-BEDB-5212A582FAB1}:

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Microsoft ISATAP Adapter

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

   IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:3497:208a:53e5:ebe9(Pref

erred)

   Link-local IPv6 Address . . . . . : fe80::3497:208a:53e5:ebe9%16(Preferred)

   Default Gateway . . . . . . . . . : ::

   NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Users>ping 208.67.222.222

Pinging 208.67.222.222 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 208.67.222.222:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users>tracert 208.67.222.222

Tracing route to 208.67.222.222 over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms  172.26.20.1

  2     *        *        *     Request timed out.

  3     *        *        *     Request timed out.

  4     *        *        *     Request timed out.

  5     *        *        *     Request timed out.

  6     *        *        *     Request timed out.

  7     *        *        *     Request timed out.

  8     *        *        *     Request timed out.

  9     *        *        *     Request timed out.

10     *        *        *     Request timed out.

11     *        *        *     Request timed out.

12     *        *        *     Request timed out.

13     *        *        *     Request timed out.

14     *        *        *     Request timed out.

15     *        *        *     Request timed out.

16     *        *        *     Request timed out.

17     *        *        *     Request timed out.

18     *        *        *     Request timed out.

19     *        *        *     Request timed out.

20     *        *        *     Request timed out.

21     *        *        *     Request timed out.

22     *        *        *     Request timed out.

23     *        *        *     Request timed out.

24     *        *        *     Request timed out.

25     *        *        *     Request timed out.

26     *        *        *     Request timed out.

27     *        *        *     Request timed out.

28     *        *        *     Request timed out.

29     *        *        *     Request timed out.

30     *        *        *     Request timed out.

Trace complete.

22 Replies 22

Hi,

I posted the requested information yesterday morning,  but instead of it being at the bottom it put the post above.

Thank you again for your assistance.

Jerry

Hi Jerry,

Its asymmetric routing that is happening here.

So

Source-----Dmz-ASA-outside---Internet---destination

If the host is connected on DMZ interface, why we are not seeing any traffic ingress to that interface; however we can see the traffic leaving outside interface. Firewall is dropping the traffic as is unable to find the source interface of the traffic.

Any specific Reasons why we are using E0/5 as trunk and if we can create a seperate interface for DMZ and DMZ2.

Please try this and let us know how it goes also check for the ouput of and see if we are getting the arp for the source

192.168.1.231 from dmz interface only.

show arp | in dmz

Cheers,

Naveen

Naveen,

Here is the DMZ ARP:

mxfw(config)# show arp | in dmz

        dmz 172.26.20.21 b888.e3fd.0b90 30

I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.

I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.

The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.

E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).

So for a simple diagram:

PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)

Let me know if this makes sense to you.

Thank you for your assistance.

Jerry

PS - I just created e0/4 as an access port for VLAN 20 and connected my computer directly to that port. The computer still cannot ping my DNS provider address: 208.67.222.222. So it is the same situation that I am not getting to the internet.

Hello Gerald,

So the ASA learns the host sending the ICMP traffic is behind the DMZ interface,

Can you do

ping dmz 172.16.20.22

Here is what I want u to do

no nat (dmz,any)  source static DMZ_Network DMZ_Network destination static Generic_All_Network Generic_All_Network

nat (dmz,outside )  2source static DMZ_Network DMZ_Network

no cap capo

no cap capd

cap capin interface dmz match icmp any host 4.2.2.2

cap capout interface outside match icmp any host 4.2.2.2

Then from that client try to ping 4.2.2.2

afterwards

show cap capin

show cap capout

show cap asp | include 4.2.2.2

show logging | include 4.2.2.2

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Julio,

I will look at that tomorrow. Also found some things in the switch to change as well.

Open DNS (208.67.222.222) should work just as well as 4.2.2.2 (I can get to the address from the Inside network) but I will try 4.2.2.2 as well.

Thanks again, I will gather this information in the morning and get it to you. I have been up since 4pm yesterday and am no longer at the site.

Jerry

Sure,

I used 4.2.2.2 but you could use whatever you want.

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Julio,

While working on another issue, I had a second set of eyes review the configs in my switches and one of the switches hadn't fully had it's VLAN 20 & 22 information removed, therefore it was causing this issue.

Also, becuase I hadn't cleared the AQRP table of my computer when I moved it from the switch to be directly connected to the ASA, it was still trying to access the switch which hadn't been configured to support the DMZ traffic any longer.

Sorry for the confusion.  Once again, thak you for your assistance.

Jerry

Hello Gerald,

It is our pleasure to help,

Regards,

Jcarvaja

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: