3

I am fairly new to the ASA world. Basically I have exhausted all my search options, and turning to experts here for help. I have an ASA 5506-X with 4 interfaces. ASA is running OS 9.4(2) and I am using ASDM to configure everything. ASDM is version 7.6

Interface 1: Outside Network 1 Verizon

Interface 2: Inside Network

Interface 3: Outside Network Comcast

Interface 4: DMZ 192.168.1.0/24

There are two outside networks, in case one goes down, it fails over to the second one.

Aside from these interfaces, ASA is also used for VPN connectivity.

My Problem: I have an Skype for Business Edge Server that I would like people to access from outside. The server is connected to the DMZ and has 3 Private IPs Nated to Public IPs. I have created the NAT rules and the server is connected to the internet (meaning i can go on the server and surf the web). I can't for some reason ping the server or connect to it from outside using any of the 3 public IPs. I have opened the necessary ports using ACL, but still no luck. Any idea on how I could get this up and running? I really appreciate any help with this. Like I said, I have researched this a lot and I couldn't find any solutions. I apologize if this question has already been asked.

Config below: 

Result of the command: "show running-config"
: Saved
: Serial Number: XXXXXXXXX
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
ASA Version 9.4(2) 
!
hostname ASA-5506-ASA
domain-name xxxx
enable password xxxxx encrypted
names
ip local pool VPN_Pool 172.xx.xx.1-172.xx.xx.254 mask 255.255.255.0
!
interface GigabitEthernet1/1
 description Verizon
 nameif outside
 security-level 0
 ip address 207.xx.xx.xx 255.255.255.224 
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 172.xx.xx.1 255.255.255.0 
!
interface GigabitEthernet1/3
 nameif COMCAST
 security-level 0
 ip address 23.xx.xx.xx 255.255.255.248 
!
interface GigabitEthernet1/4
 description DMZ Interface
 nameif DMZ
 security-level 50
 ip address 192.168.1.254 255.255.255.0 
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
boot system disk0:/asa942-lfbff-k8.SPA
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup COMCAST
dns domain-lookup DMZ
dns server-group DefaultDNS
 name-server 172.xx.xx.x6
 domain-name xxxxx
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_172.xx.xx.0_24
 subnet 172.xx.xx.0 255.255.255.0
object network CUCM-6970
 host 172.xx.xx.10
object network CUCM-69
 host 172.xx.xx.10
object service RDP
 service tcp source eq 3389 destination eq 3389 
 description Remote Desktop
object service RDP_UDP
 service udp source eq 3389 destination eq 3389 
 description Remote Desktop UDP
object network RDP-Access
 host 17x.xx.xx.xx
 description RDP Access
object network Public_Pool
 range 23.xx.xx.xx 23.xx.xx.xx
object network DMZ-Subnet
 subnet 192.168.1.0 255.255.255.0
object network DMZ-Edge-Access-EXT
 host 23.xx.xx.xx
object network DMZ-Edge-Access-INT
 host 192.168.1.xx
object network DMZ-Edge-Web-Conf-EXT
 host 23.xx.xx.xx
object network DMZ-Edge-Web-Conf-INT
 host 192.168.1.xx
object network DMZ-Edge-Audio-Video-EXT
 host 23.xx.xx.xx
object network DMZ-Edge-Audio-Video-INT
 host 192.168.1.xx
object service Access-Edge-Federation
 service tcp source eq 5061 destination eq 5061 
 description Port used for Access Edge Federation
object service AV-Edge-UDP-3478
 service udp source eq 3478 destination eq 3478 
 description AV-Edge-UDP-3478
object service DNS
 service tcp source eq domain destination eq domain 
 description DNS
object service DNSU
 service udp source eq domain destination eq domain 
 description DNSU
object-group network DM_INLINE_NETWORK_1
 network-object object CUCM-69
 network-object object CUCM-6970
object-group service DM_INLINE_SERVICE_1
 service-object tcp destination eq 6970 
 service-object udp destination eq tftp 
object-group service AV-Edge-TCP-50-59 tcp
 description Allowing TCP Ports 50000 to 59999
 port-object range 50000 59999
object-group service AV-Edge-UDP-50-59 udp
 description Allowed UDP Ports 50000 to 59999
 port-object range 50000 59999
access-list SplitTunnel standard permit 172.xx.63.0 255.255.255.0 
access-list SplitTunnel standard permit 172.xx.63.0 255.255.255.0 
access-list SplitTunnel standard permit 172.xx.60.0 255.255.254.0 
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_1 
access-list COMCAST_access_in extended permit tcp any object RDP-ACCESS eq 3389 
access-list DMZ_access_in remark Allowed Port 443 for Access Edge
access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Access-EXT eq https inactive 
access-list DMZ_access_in remark Allowed port 5061 for access edge federation
access-list DMZ_access_in extended permit object Access-Edge-Federation any object DMZ-Edge-Access-EXT inactive 
access-list DMZ_access_in remark Allowed TCP 443 for Web Conferencing
access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Web-Conf-EXT eq https inactive 
access-list DMZ_access_in remark Allowed TCP 443 for Audio/Video access
access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Audio-Video-EXT eq https inactive 
access-list DMZ_access_in remark Allowed UDP 3478 for Audio/Video
access-list DMZ_access_in extended permit object AV-Edge-UDP-3478 any object DMZ-Edge-Audio-Video-EXT inactive 
access-list DMZ_access_in remark Allowed TCP Ports 50000 to 59999
access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Audio-Video-EXT object-group AV-Edge-TCP-50-59 inactive 
access-list DMZ_access_in remark Allowed UDP Ports 50000 to 59999
access-list DMZ_access_in extended permit udp any object DMZ-Edge-Audio-Video-EXT object-group AV-Edge-UDP-50-59 inactive 
access-list DMZ_access_in extended permit ip object DMZ-Subnet any 
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu COMCAST 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-761.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static NETWORK_OBJ_172.xx.63.0_24 NETWORK_OBJ_172.xx.63.0_24 no-proxy-arp route-lookup
!
object network CUCM-6970
 nat (inside,outside) static interface service tcp 6970 6970 
object network CUCM-69
 nat (inside,outside) static interface service udp tftp tftp 
object network RDP-ACCESS
 nat (inside,COMCAST) static interface no-proxy-arp service tcp 3389 3389 
object network DMZ-Subnet
 nat (DMZ,COMCAST) dynamic interface
object network DMZ-Edge-Access-INT
 nat (DMZ,COMCAST) static DMZ-Edge-Access-EXT
object network DMZ-Edge-Web-Conf-INT
 nat (DMZ,COMCAST) static DMZ-Edge-Web-Conf-EXT
object network DMZ-Edge-Audio-Video-INT
 nat (DMZ,COMCAST) static DMZ-Edge-Web-Conf-EXT
!
nat (inside,COMCAST) after-auto source dynamic any interface
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
access-group COMCAST_access_in in interface COMCAST
access-group DMZ_access_in in interface DMZ
route COMCAST 0.0.0.0 0.0.0.0 23.xx.xx.xx 1
route outside 0.0.0.0 0.0.0.0 207.xx.xx.xx 50
route inside 172.xx.60.0 255.255.254.0 172.xx.63.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect sunrpc 
  inspect xdmcp 
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:ee5c940e2787f16d3e83ef7eedf943a4
: end
Improve this question
5
  • Please post your ASA config (sanitized if necessary). Otherwise, we're only guessing.
    – Ron Trunk
    May 5, 2016 at 15:20
  • Hi Ron, Please see the config using the link. I could't copy and paste it here due to the character limit. [link] (onedrive.live.com/…)
    – Doug
    May 5, 2016 at 15:51
  • added it to my original question.
    – Doug
    May 5, 2016 at 16:01
  • Doug, please set your logging to debug and capture the logs while you attempt a connection. Then post that. I was going to load your config on a spare ASA, but someone needed it (Something about work. Go figure :).
    – Ron Trunk
    May 6, 2016 at 18:18
  • Hi Ron, I figured it out. It had something to do with ACL.
    – Doug
    May 13, 2016 at 14:35

2 Answers 2

Reset to default
3

Your access lists for the two outside interfaces do not have the necessary permits. For example, to permit in ICMP, you'd need a 'permit icmp' entry that would allow pings into the DMZ servers. For your specific application ports you need to add lines for those as well.

Right now your inbound ACLs from the internet just look like this:

!
! For your Verizon connection:
!
object-group service DM_INLINE_SERVICE_1
 service-object tcp destination eq 6970 
 service-object udp destination eq tftp
!
object-group network DM_INLINE_NETWORK_1
 network-object object CUCM-69
 network-object object CUCM-6970
!
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_1
!
!
! For your Comcast connection:
!
object network RDP-Access
 host 17x.xx.xx.xx
 description RDP Access
!
access-list COMCAST_access_in extended permit tcp any object RDP-ACCESS eq 3389

All other traffic not explicitly listed here is being dropped by the Implicit Deny at the end of any ACL on the ASA.

For example to permit ICMP (for IPv4) I usually just let a few ICMP type/codes through to all destinations (in your case, I'll give an example with just those hosts that have static NAT translations).

object-group service ICMP_ALLOWED
 service-object icmp echo
 service-object icmp echo-reply
 service-object icmp unreachable
 service-object icmp time-exceeded

object-group network OUTSIDE_ACCESSIBLE_HOSTS
 network-object object DMZ-Edge-Access-INT
 network-object object DMZ-Edge-Web-Conf-INT
 network-object object DMZ-Edge-Audio-Video-INT

access-list COMCAST_access_in line 1 extended permit object-group ICMP_ALLOWED any object-group OUTSIDE_ACCESSIBLE_HOSTS

(It's also worth noting as well, that if Comcast gave you those public IPs that you're using in the static NAT statements, they won't work out your Verizon connection.)

Improve this answer
1
  • Thank you sir for your through explanation. Your explanation helped me resolved this issue.
    – Doug
    May 13, 2016 at 14:36
1

If you configure NAT for an inside server, that it has a public IP address on the outside interface, then you have to configure an access rule to allow the outside traffic to access the inside server that needs to reference the server’s real IP address, and not the public IP:

Example:

ASA(config)# name 192.168.1.X skype_server

ASA(config)# object network DMZ-Subnet

ASA(config-network-object)# host skype_server

ASA(config-network-object)# nat (inside,outside) static 'public_ip'

ASA(config)# access-list outside_rule extended permit tcp any host skype_server eq 'ports (if necessary)'

ASA(config)# access-group outside_rule in interface outside

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.