1

I have a serious concern that I can not solve. Thank you for helping me.
I have a network with a configuration ASA 5512 (Inside, outside, DMZ) that works well. Now I would like to use the graphical utility to be able to have a centralized management of Cisco all equipments. But I can not ping a LAN machine from the router and is not visible by the CCP graphical utility. But i access the router from the LAN inside. Here is my basic configuration

IP firewall: 192.168.100.253  
IP router: 192.168.100.254  
inside: 192.168.0.0/24  
outside: 192.168.100./24  
DMZ: 1923.168.1.0/24

I have access to the internet in this way
router --> firewall --> inside and DMZ
I think the firewall prevents to the router any communication with the LAN (inside which is bormal).
But I would like the router communicate with my admin PC or any other PC located in the LAN. For that, I have defined a nat (outside, inside) and an access rule for the address 192.168.100.254 but I still can not get through the firewall with the router address. Here is my Firewall configuration

ASA Version 9.1(2)
!  
hostname teropaz
enable password HiGcJ9e0GTkEROyY encrypted
names  
ip local pool DHCP_VPN 192.168.0.150-192.168.0.160 mask 255.255.255.0  
ip local pool DHCP_VPN1 192.168.1.40-192.168.1.50 mask 255.255.255.0  
!  
interface GigabitEthernet0/0
 nameif outside  
 security-level 0  
 ip address 192.168.100.253 255.255.255.0  
!  
interface GigabitEthernet0/1  
 nameif inside  
 security-level 100  
 ip address 192.168.0.254 255.255.255.0  
!  
interface GigabitEthernet0/2  
 nameif dmz  
 security-level 50  
 ip address 192.168.1.254 255.255.255.0  
!    
interface GigabitEthernet0/3  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface GigabitEthernet0/4  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface GigabitEthernet0/5  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface Management0/0  
 management-only  
 nameif management  
 security-level 100  
 ip address 192.168.3.1 255.255.255.0  
!  
ftp mode passive  
dns domain-lookup outside  
dns domain-lookup inside  
dns domain-lookup dmz  
dns domain-lookup management  
same-security-traffic permit inter-interface  
same-security-traffic permit intra-interface  
object network INSIDE-LAN-SUBNET  
 subnet 192.168.0.0 255.255.255.0  
object network DMZ-LAN-SUBNET  
 subnet 192.168.1.0 255.255.255.0  
object network dmz  
 subnet 192.168.1.0 255.255.255.0  
object network Sortie_IP_CAMTEL  
 host 154.107.154.178  
object network webserver  
 host 192.168.1.103  
object network NETWORK_OBJ_192.168.0.128_26  
 subnet 192.168.0.128 255.255.255.192  
object network NETWORK_OBJ_192.168.1.32_27  
 subnet 192.168.1.32 255.255.255.224  
object network ROUTER-INSIDE  
 host 192.168.100.254  
object-group service HTTP_HTTPS  
 service-object tcp destination eq www  
 service-object tcp destination eq https  
access-list outside_acl extended permit tcp any object webserver eq www  
access-list dmz_access_in extended permit ip any 192.168.0.0 255.255.255.0  
access-list dmz_access_in extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0  
 255.255.255.0  
access-list dmz_access_in extended permit object-group HTTP_HTTPS 192.168.1.0 255.255.255.0 any  
access-list dmz_access_in extended permit ip 192.168.1.0 255.255.255.0 any  
access-list global_access extended permit ip  object ROUTER-INSIDE object INSIDE-LAN-SUBNET 
access-list global_access extended permit icmp  
object ROUTER-INSIDE object INSIDE-LAN-SUBNET  
mtu outside 1500  
mtu inside 1500  
mtu dmz 1500  
mtu management 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
no arp permit-nonconnected  
nat (inside,outside) source static any any destination static  
 NETWORK_OBJ_192.168.0.128_26  
 NETWORK_OBJ_192.168.0.128_26 no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static  
 NETWORK_OBJ_192.168.1.32_27 NETWORK_OBJ_192.168.1.32_27 no-proxy-arp route-lookup  
nat (outside,inside) source static any ROUTER-INSIDE  
!  
object network INSIDE-LAN-SUBNET  
 nat (inside,outside) dynamic interface  
object network DMZ-LAN-SUBNET  
 nat (dmz,outside) dynamic interface  
object network webserver  
 nat (dmz,outside) static Sortie_IP_CAMTEL  
 service tcp www www  
access-group outside_acl in interface outside  
access-group dmz_access_in in interface dmz  
access-group global_access global  
route outside 0.0.0.0 0.0.0.0 192.168.100.254 1  
timeout xlate 3:00:00  
timeout pat-xlate 0:00:30  
timeout conn 1:00:00  
half-closed 0:10:00  
udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225  
 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
timeout floating-conn 0:00:00  
dynamic-access-policy-record DfltAccessPolicy  
user-identity default-domain LOCAL  
http server enable  
http 192.168.3.0 255.255.255.0 management  
no snmp-server location  
no snmp-server contact  
telnet timeout 5  
ssh timeout 5  
ssh key-exchange group dh-group1-sha1  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.2.254 \\SaveConfigCisco\aa  

!  
class-map inspection_default
 match default-inspection-traffic
!  
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map  
  inspect ftp  
  inspect h323 h225  
  inspect h323 ras  
  inspect rsh  
  inspect rtsp  
  inspect esmtp  
  inspect sqlnet  
  inspect skinny  
  inspect sunrpc  
  inspect xdmcp  
  inspect sip  
  inspect netbios  
  inspect tftp  
  inspect ip-options  
  inspect icmp  
!  
service-policy global_policy global  
prompt hostname context  
no call-home reporting anonymous
Cryptochecksum:6b52d456c89ffc95b92c353bf4c5467a
: end  
ciscoasa#

Here's the router configuration 

Current configuration : 9240 bytes
!
! Last configuration change at 16:03:54 UTC Thu Dec  
20 2018
version 15.3

!  
hostname xxxx  
!  
boot-start-marker  
boot system tftp c2900-universalk9-mz.SPA.156-1.T1.bin 255.255.255.255  
boot system flashO:/c2900-universalk9-mz.SPA.155-3.M3.bin  
boot system flash0:/c2900-universalk9-mz.SPA.153-3.M3.bin  
boot-end-marker  
!  
aqm-register-fnf  
!  
! card type command needed for slot/vwic-slot 0/0  
no logging console  
enable secret 4 tnhtc92DXBhelxjYk8LWJrPV36S2i4ntXrpb4RFmfqY  
!  
no aaa new-model  
!  
!  
no ip domain lookup  
ip domain name savannah-osc.com  
ip cef  
no ipv6 cef  
multilink bundle-name authenticated  
!!  
!  
voice-card 0  
!  
!  
!license udi pid CISCO2911/K9 sn FTX1807AHKY  
license accept end user agreement  
license boot module c2900 technology-package uck9
hw-module pvdm 0/0  
!  
!  
file privilege 0  

redundancy  
!  
!  
interface Embedded-Service-Engine0/0  
 no ip address  
 shutdown  
!  
interface GigabitEthernet0/0  
 description INTERFACE INTERNET  
 ip address 154.72.154.122 255.255.252.0  
 ip nat outside  
 ip virtual-reassembly in  
 duplex auto  
 speed auto  
!  
interface GigabitEthernet0/1  
 description INTERFACE LAN INTERNE  
 ip address 192.168.100.254 255.255.255.0  
 ip access-group 101 in  
 ip nat inside  
 ip virtual-reassembly in  
 duplex auto  
 speed auto  
!  
interface GigabitEthernet0/2  
 ip address 192.168.5.1 255.255.255.0  
 duplex auto  
 speed auto  
!  
ip forward-protocol nd  
!  
ip http server  
ip http port 8080  
ip http authentication local  
ip http secure-server  
ip http path flash:  
!  
ip nat inside source list 1 interface   
 GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 154.107.154.178  
!  
!  
access-list 1 permit 192.168.100.0 0.0.0.255  
access-list 10 permit 192.168.100.0 0.0.0.255  
!  
control-plane  
!  
 login local  
 transport input all  
line vty 5 15  
 password 74éz_iào555*$£  
 login local  
 transport input all  
!  
scheduler allocate 20000 1000  
!  
end
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 10:28

1 Answer 1

Reset to default
2

The only connection that can be made from the outside is defined by this access list:

access-list outside_acl extended permit tcp any object webserver eq www

You'll need to add to your access list to allow your router to reach your management host.

EDIT

On the router interface

interface GigabitEthernet0/1

You have this ACL:

 ip access-group 101 in

But that ACL doesn't exist, so it will drop all traffic.

Improve this answer
16
  • Thank you Ron for your prompt reaction. Unless I understand badly, this access has already been defined. but the router does not always access the LAN. I do not quite see what should be specified in the acces_list. Thank you
    – Jean-Louis K.
    Commented Dec 13, 2018 at 20:03
  • The only thing you have allowed is access to 192.168.1.103 on port 80. You need to add another line to allow the router interface to reach your host.
    – Ron Trunk
    Commented Dec 13, 2018 at 20:11
  • Ok I want to allow access to any machine in the LAN from the router.I will add the line and inform you . Thank you
    – Jean-Louis K.
    Commented Dec 13, 2018 at 20:21
  • I have add the line but stiil droped by configured rule
    – Jean-Louis K.
    Commented Dec 13, 2018 at 20:32
  • Post the line so we can see it.
    – Ron Trunk
    Commented Dec 13, 2018 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.