Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Cannot Ping from DMZ to Outside1 (Security level 100) Networks

I have an ASA5510, i configured an Outside, 1 DMZ and 2 100 security level interfaces. I can ping and have fluid traffic between DMZ and 1 interface 100 security level (Inside), but don't have any kind of traffic between DMZ and the other 100 Security Level interface (Outside1). I suppoused to write the same configuration for both 100 Security Level interfaces and DMZ. Some one can help me?

 

Here's the configuration

 

: Saved

:

ASA Version 8.2(1)

!

hostname ASAFCHFW

domain-name a.b.c

enable password 6Jfo5anznhoG00fM encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

 nameif Outside

 security-level 0

 ip address x.y.z.162 255.255.255.248

!

interface Ethernet0/1

 nameif Outside1

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Ethernet0/2

 nameif DMZ

 security-level 10

 ip address 172.16.31.1 255.255.255.0

!

interface Ethernet0/3

 nameif Inside

 security-level 100

 ip address 192.168.0.1 255.255.255.0

!

interface Management0/0

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0

 management-only

!

boot system disk0:/asa821-k8.bin

ftp mode passive

dns server-group DefaultDNS

 domain-name farmaciachavez.com.bo

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list dmz_in extended permit tcp host 172.16.31.2 any eq domain

access-list dmz_in extended permit tcp host 172.16.31.2 any eq smtp

access-list dmz_in extended permit tcp host 172.16.31.2 any eq www

access-list dmz_in extended permit tcp host 172.16.31.2 any eq https

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 3000

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 1000

access-list Inside extended permit ip any any

access-list Inside extended permit icmp any any

access-list 100 extended permit tcp any host x.y.z.163 eq smtp

access-list 100 extended permit udp any host x.y.z.163 eq domain

access-list 100 extended permit tcp any host x.y.z.163 eq https

access-list 100 extended permit tcp any host x.y.z.163 eq www

access-list 100 extended permit tcp any host x.y.z.163 eq 3000

access-list 100 extended permit tcp any host x.y.z.163 eq 1000

pager lines 24

logging enable

logging buffered debugging

logging asdm informational

mtu Outside 1500

mtu Outside1 1500

mtu DMZ 1500

mtu Inside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit host 192.168.0.22 Outside

icmp permit 192.168.0.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 Outside1

icmp permit 172.16.31.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 DMZ

icmp permit 192.168.2.0 255.255.255.0 Inside

icmp permit 192.168.0.0 255.255.255.0 Inside

icmp permit 172.16.31.0 255.255.255.0 Inside

asdm image disk0:/asdm-647.bin

asdm history enable

arp timeout 14400

global (Outside) 101 interface

nat (Outside1) 101 0.0.0.0 0.0.0.0

nat (DMZ) 101 0.0.0.0 0.0.0.0

nat (Inside) 101 0.0.0.0 0.0.0.0

static (DMZ,Outside) x.y.z.163 172.16.31.0 netmask 255.255.255.255

static (DMZ,Inside) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Inside,Outside1) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

static (DMZ,Outside1) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,DMZ) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.2.0 172.1.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.3.0 172.1.3.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0

static (Outside1,DMZ) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

access-group dmz_in in interface DMZ

route Outside 0.0.0.0 0.0.0.0 x.y.z.161 20

route Outside1 172.1.1.0 255.255.255.0 192.168.2.2 1

route Outside1 172.1.2.0 255.255.255.0 192.168.2.2 1

route Outside1 172.1.3.0 255.255.255.0 192.168.2.2 1

route Outside1 192.1.0.0 255.255.192.0 192.168.2.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 192.168.0.0 255.255.255.0 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 192.168.0.0 255.255.255.0 Inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:7441424d1fcf87c3eb837b569e84aa9e

: end

1 REPLY
New Member

Hi , Please confirm from

Hi ,

 

Please confirm from which direction you are initiating the traffic,. Can you ping destination IP's from firewall first place.  also please me know why you have added i-nat on Outside1 to DMZ and vice versa.

 

 

 

 

120
Views
0
Helpful
1
Replies
CreatePlease to create content