Glad to join the forum. I hope to get help too and help as much as I can. Currently I have a big problem. I am using Cisco ASA 5512. I defined 3 interfaces on the firewall: inside (, outside ( and DMZ ( which includes web servers and other VPN sevices. The DMZ can not access the internet, despite everything I think I have done. Can more experienced people and specialists help me? Here is the firewall configuration Thank you

: Saved
ASA Version 9.1(2)
hostname ciscoasa

enable password HiGcJ9e0GTkEROyY encrypted

passwd WixegyNLwa6OgUk7 encrypted



interface GigabitEthernet0/0

 nameif outside

 security-level 0

 ip address


interface GigabitEthernet0/1

 nameif inside

 security-level 100

 ip address


interface GigabitEthernet0/2

 nameif dmz

 security-level 50

 ip address


interface GigabitEthernet0/3


 no nameif

 no security-level

 no ip address


interface GigabitEthernet0/4


 no nameif

 no security-level

 no ip address

interface GigabitEthernet0/5


 no nameif

 no security-level

 no ip address


interface Management0/0


 nameif management

 security-level 100

 ip address


ftp mode passive

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network INSIDE-LAN-SUBNET


object network DMZ-LAN-SUBNET

object network dmz


object network webserver-IP_MTN

 host xxx.xxx.xxx.xxx

object network webserver


access-list outside_acl extended permit tcp any object webserver eq www

access-list dmz_access_in extended permit ip any

access-list dmz_access_in extended permit ip

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu dmz 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected


object network INSIDE-LAN-SUBNET

 nat (inside,outside) dynamic interface

object network DMZ-LAN-SUBNET

 nat (dmz,outside) dynamic interface

object network webserver

 nat (dmz,outside) static webserver-IP_MTN service tcp www www

access-group outside_acl in interface outside

access-group dmz_access_in in interface dmz

route outside 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd address inside

dhcpd dns interface inside

dhcpd lease 86400 interface inside

dhcpd domain savannah.local interface inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

tftp-server inside \\SaveConfigCisco\aa

class-map inspection_default

 match default-inspection-traffic


policy-map type inspect dns preset_dns_map


  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous


: end
  • 1
    If you simulate traffic using packet-tracer, what does it say? Like, if you do packet-tracer input DMZ tcp 1234 80 does it say it's being blocked or allowed, and hitting the right statements Along the way?
    – Jesse P.
    Commented Aug 28, 2018 at 11:15
  • HI dear Jesse when I simulate as you suggested, the packet still droped Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule Commented Aug 29, 2018 at 8:09
  • Hi Jesse. My apologies for the delay. I was sent out of the office. When I simulate as you proposed, the package is always dropped: Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule Commented Aug 29, 2018 at 8:19

1 Answer 1


I just re-read your ACLs. Sorry I didn't catch it before but, you're missing statements to allow you to get to public IPs. All you've currently got are rules to allow you to get to other private IPs.

Just add:

object-group service HTTP_HTTPS
 service-object tcp destination eq 80
 service-object tcp destination eq 443

access-list dmz_access_in extended permit HTTP_HTTPS any

It should work after that if your route statement is correct and you are truly using another private IP as your next hop. If that's wrong or this just doesn't work, you will need to provide a diagram of how your equipment is connected and what your public IPs, mask, and gateway are (as provided by your ISP).

  • Yes I'm trying to add the commands I will let you know Commented Aug 29, 2018 at 12:22
  • Superb. It works. At first I only allowed HTTP-HTTPS. I also allowed ip, and it worked. congratulations and thank you and thank you very much. Commented Aug 29, 2018 at 12:40
  • @Jean-LouisK. Sure. Adjust it as needed. If my answer solved your problem, please mark it as the answer and upvote it.
    – Jesse P.
    Commented Aug 29, 2018 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.