Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA Basic configurations

Hi,
I have ASA 5510 8.4 with the following interfaces:
inside -------------->192.168.1.0/24 (sec-level=100)
DMZ    -------------->192.168.2.0/24 (sec-level=50)
outside ------------->192.168.3.0/24 (sec-level=0)

my isp nat the public ip x.x.x.x to 192.168.3.10

in the dmz i have exchange server (192.168.2.10)

1- what is the configuration to allow both inside and dmz get access to internet

2- what is the configuration to receive emails from internet 

3- how i can allow access from dmz to inside network ????

thnks

 

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

LA-Engineer (and tareken87)

LA-Engineer (and tareken87):

An outside default route would point to the next hop gateway, not the interface itself.

There's no need for an access-list on the inside as it will permit any traffic to all lower security interfaces by default.

If you allow DMZ access to ip any any (including the inside) then you defeat the whole purpose of having a DMZ. One should analyze the required protocols host and ports for DMZ-Inside and allow only those in the access-list.

5 REPLIES

Hi , share existing show run

Hi ,

 share existing show run configuration from your ASA
 

HTH

Sandy

New Member

If you have the IP addresses

If you have the IP addresses already configured then the first thing you'll need to do is configure a default route.

route outside 0.0.0.0 0.0.0.0 192.168.3.10

Then, you may need to nat your inside and dmz to our outside ip address.

nat (inside,outside) source dynamic any interface 

nat (DZM,outside) source dynamic any interface

Then, you'll need to permit it in the interface access-llist if you have one configured:

access-list inside_access_in permit ip any any

access-list DMZ_access_in permit ip any any  ! this permits DMZ to inside as well.

Then, you may need to configure inspection if you havent already.

Hall of Fame Super Silver

LA-Engineer (and tareken87)

LA-Engineer (and tareken87):

An outside default route would point to the next hop gateway, not the interface itself.

There's no need for an access-list on the inside as it will permit any traffic to all lower security interfaces by default.

If you allow DMZ access to ip any any (including the inside) then you defeat the whole purpose of having a DMZ. One should analyze the required protocols host and ports for DMZ-Inside and allow only those in the access-list.

New Member

tarekaen87, sorry, I mistook

tarekaen87, sorry, I mistook that for the next hop.  Yes, you would obviously need to set it to the next hop gateway.. not itself.  The next-hop gateway will be the ISP router's IP address (192.168.3.x). 

 

Marvin is right.. if you have one configured the traffic will need to be permitted in the ACL.  If not then you don't.  Some organizations like to control what traffic is allowed from one zone into another regardless of the security level.  The point is, you'll need to allow the traffic if you do have an ACL configured.  Otherwise, traffic will be allowed from higher security to lower security by default.  So for the DMZ to Inside access, you need to just permit the traffic that you want.  If you want all traffic then you will permit any.  Otherwise, specify the source and destination IP/ports in your ACL entries.

 

I hope that helps.  Let me know if any of this doesn't make sense.  

New Member

Depending on all your replies

Depending on all your replies , I will write command as I understand and kindly correct me if I am wrong:

interface ethernet 0/1

nameif inside

security-level 100

ip address 192.168.1.254  255.255.255.0

 

interface ethernet 0/2

nameif dmz

security-level 50

ip address 192.168.2.2  255.255.255.0

 

interface ethernet 0/3

nameif outside

security-level 0

ip address 192.168.3.2  255.255.255.0

 

route outside 0.0.0.0  0.0.0.0 192.168.3.1

 

object-network  pat_to_interface

subnet 0.0.0.0  0.0.0.0

 

nat (inside,outside)  source dynamic pat_to_interface  interface

 

object network mail_server

host 192.168.2.10

nat (dmz,outside) static 192.168.3.10

 

access list  outside_TO_dmz  extend permit tcp any host 192.168.2.10 eq 25

access- group outside_TO_dmz  in interface outside

 

access list dmz_TO_inside extend permit tcp host 192.168.2.10 host 192.168.1.11 eq 53

 

 

 

72
Views
3
Helpful
5
Replies