Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

port 80 blocked from dmz to outside

I have an ASA 5510 with a DMZ port sub-interfaced to 3 ports. The 3 interfaces are set up the same with security level 50. The outbound rules for the interfaces are the same except obviously for the source. On the first and second sub-interface i can get to the internet but on the 3rd interface i can not. When trying to access the internet i get a deny message in the syslog. The ASDM reports it as the result of an implicit rule. As far as i know, this should be allowed since it is going to a less secure interface.

6 REPLIES
Green

Re: port 80 blocked from dmz to outside

Do you mind posting the config?

Community Member

Re: port 80 blocked from dmz to outside

Can you please let me know if i have forgotten to parse anything out and when and if i can remove the attachment.

Green

Re: port 80 blocked from dmz to outside

You can pull it now.

Green

Re: port 80 blocked from dmz to outside

Could you post the error message you are getting.

"As far as i know, this should be allowed since it is going to a less secure interface."

-Not necessarily...you have an acl applied into DMZ-13 interface, therefore anything not specifically allowed will be denied, regardless of where it's going.

Community Member

Re: port 80 blocked from dmz to outside

4 Sep 10 2007 10:14:05 106023 CYCLOPS 170.224.191.33 Deny tcp src DMZ-13:CYCLOPS/4482 dst outside:170.224.191.33/80 by access-group "DMZ-13_access_in" [0x0, 0x0]

Green

Re: port 80 blocked from dmz to outside

You have to allow that in your DMZ-13_access_in access list.

If you want to allow all the access to the outside then you should do this.

Take your existing acl, add a deny ip any to your other dmz/inside networks. Then add a permit ip any any to allow any other access to outside network.

access-list DMZ-13_access_in deny ip any

access-list DMZ-13_access_in deny ip any

access-list DMZ-13_access_in permit ip any any

180
Views
0
Helpful
6
Replies
CreatePlease to create content