3

I just got my software upgraded from v8.2(x) to v.9.1(7), but I have some general issues with access to and from my DMZ:

  1. No internet access from DMZ
  2. No access to web or mail server from outside to DMZ

Here is my running-config:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 109.xxx.yyy.zzz 255.255.255.128
!
interface GigabitEthernet0/1
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
!
interface GigabitEthernet0/2
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/3
 nameif data
 security-level 100
 ip address 10.0.0.1 255.255.255.0
!
interface Management0/0
 nameif mgmt
 security-level 0
 ip address 192.168.128.1 255.255.255.0
!
...
object network obj-dmz-subnet
 subnet 172.16.1.0 255.255.255.0
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network obj-lan-subnet
 subnet 192.168.1.0 255.255.255.0
object network obj-data-subnet
 subnet 10.0.0.0 255.255.255.0
object network obj-mgmt-subnet
 subnet 192.168.128.0 255.255.255.0
object network web_server
 host 172.16.1.30
object network web_server_http
 host 172.16.1.30
object network web_server_https
 host 172.16.1.30
object network mail_server_smtp
 host 172.16.1.40
object network mail_server_pop3
 host 172.16.1.40
object network mail_server_imap
 host 172.16.1.40
object network mail_server_pop3s
 host 172.16.1.40
object network mail_server_imaps
 host 172.16.1.40
object network mail_server_smtps
 host 172.16.1.40
object-group network web_servers
 network-object host 172.16.1.30
object-group network mail_servers
 network-object host 172.16.1.40
object-group service web_services tcp
 port-object eq www
 port-object eq https
object-group service mail_services tcp
 port-object eq smtp
 port-object eq imap4
 port-object eq pop3
 port-object eq 995
 port-object eq 993
 port-object eq 465
object-group service zabbix_services tcp
 port-object eq 10050
 port-object eq 10051
access-list ACL_IN extended permit ip any4 any4
access-list OUTSIDE_TO_DMZ extended permit ip any4 any4
access-list OUTSIDE_TO_DMZ extended permit tcp any object-group web_servers object-group web_services
access-list OUTSIDE_TO_DMZ extended permit tcp any object-group mail_servers object-group mail_services
access-list OUTSIDE_TO_DMZ extended deny ip any any log
access-list DMZ_TO_INSIDE extended permit tcp object obj-dmz-subnet host 192.168.1.4 object-group zabbix_services
!
object network obj-dmz-subnet
 nat (dmz,outside) dynamic interface
object network obj_any
 nat (dmz,outside) dynamic interface
object network obj-lan-subnet
 nat (inside,outside) dynamic interface
object network web_server_http
 nat (dmz,outside) static interface service tcp www www
object network web_server_https
 nat (dmz,outside) static interface service tcp https https
object network mail_server_smtp
 nat (dmz,outside) static interface service tcp smtp smtp
object network mail_server_pop3
 nat (dmz,outside) static interface service tcp pop3 pop3
object network mail_server_imap
 nat (dmz,outside) static interface service tcp imap4 imap4
object network mail_server_pop3s
 nat (dmz,outside) static interface service tcp 995 995
object network mail_server_imaps
 nat (dmz,outside) static interface service tcp 993 993
object network mail_server_smtps
 nat (dmz,outside) static interface service tcp 465 465
access-group OUTSIDE_TO_DMZ in interface outside
access-group DMZ_TO_INSIDE in interface dmz
access-group ACL_IN in interface inside
route outside 0.0.0.0 0.0.0.0 109.xxx.yyy.zzz 1

What am I missing in my configuration?

Edit: The NAT statement clean-up was the solution to one of the problems. Now I have full access to my web and mail server. However, Internet access to the DMZ still fails. Here is the result of the packet-tracer command "packet-tracer input dmz tcp 172.16.1.100 80 8.8.8.8 80":

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: dmz
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Edit: I think I have made everything work now. It helped insert the following access list:

access-list FROM_DMZ extended permit ip any any

Now I can send ping commands to the big wide world and get my machines upgraded in the DMZ. It seemed almost too easy. Is there something I have to take into account or something I have forgotten?

  • Comments are not for extended discussion; this conversation has been moved to chat. – Ron Maupin Feb 13 at 1:43
  • Nope. That access-list entry was the final missing piece. I can't say that I feel comfortable with you having it set to allow all IP protocols and all ports, but it's your decision. I prefer to only allow protocols I know are actually needed, like TCP/80 and TCP/443 (like the example I provided earlier). – Jesse P. Feb 13 at 16:28
5

Let's clean up your NAT statements a bit before we troubleshoot.

Here, we'll temporarily remove your "global" NAT statements

 object network obj-dmz-subnet
     no nat (dmz,outside) dynamic interface
 object network obj-lan-subnet
     no nat (inside,outside) dynamic interface

This next object is a default object created on ASAs, which has a corresponding NAT statement that has been known to cause problems (due to how broad it is) if you don't remove it. You aren't using it, from what I can see, so we will remove it completely.

no object network obj_any

The next 2 lines are to create your global NAT statements again, but as manual NATs (rather than auto NATs) and also using the after-auto keyword in each to make sure that they are only used as a sort of last-resort (if traffic doesn't match against any other NAT statement first).

nat (dmz,outside) after-auto source dynamic any interface
nat (inside,outside) after-auto source dynamic any interface

Now that the NAT statements are in a bit better order, can you show me some packet-tracer outputs?

packet-tracer input dmz tcp 172.16.1.100 1234 8.8.8.8 80

packet-tracer input outside tcp 8.8.8.8 1234 <your public IP for your web-server> 80

Edit:

Please add:

access-list DMZ_TO_INSIDE extended permit tcp object obj-dmz-subnet any eq 80

along with

access-list DMZ_TO_INSIDE extended permit tcp object obj-dmz-subnet any eq 443

and then perform the same packet-tracer command as you tried a moment ago. The reason it didn't work before is because you currently only allow the DMZ subnet to access your Zabbix servers.

I would suggest, since we are now NOT limiting your DMZ to only access the Zabbix servers, that you rename your DMZ access-list to make more sense.

If you want to rename your access-list, you can do so by using the command:

access-list DMZ_TO_INSIDE rename <new name>

For example: access-list DMZ_TO_INSIDE rename from_DMZ

FYI, renaming an access-list (or object) has no impact on traffic, as ASAs use an access-list and/or object's hex ID, not its name, which does not change by using the rename command. This means you can change it without fear of impacting users/servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.