5

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but again have hit a brick wall. It seems no matter what I try, the implicit rule/s block the inbound traffic. I cannot figure out how to fix this. My DMZ network is on port 7 (vlan 12) with subnet 172.16.0.0/24 and the web server IP is: 172.16.0.2

Here is my original show run:

MyASA# show running-config 
: Saved
: 
: Serial Number: 
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.2(3) 
!
hostname MyASA
domain-name labz.local
enable password encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 description labz LAN
 nameif inside
 security-level 100
 ip address 192.168.3.1 255.255.255.0 
!
interface Vlan2
 description telco-isp 100 Mbps fiber
 nameif outside
 security-level 0
 pppoe client vpdn group labzGroup
 ip address pppoe setroute 
!
interface Vlan12
 description DMZ port
 no forward interface Vlan1
 nameif DMZ
 security-level 50
 ip address 172.16.0.1 255.255.255.0 
!             
ftp mode passive
dns server-group DefaultDNS
 domain-name labz.local
same-security-traffic permit inter-interface
object network show
object network dmz-subnet
 subnet 172.16.0.0 255.255.255.0
object network webserver
 host 172.16.0.2
object-group icmp-type PING-both
 description PING echo & echo-reply
 icmp-object echo
 icmp-object echo-reply
access-list outside_acl extended permit tcp interface outside object webserver eq https 
access-list outside_acl extended permit tcp interface outside object webserver eq www 
access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq www 
access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq https 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo-reply outside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network dmz-subnet
 nat (DMZ,outside) dynamic interface
object network webserver
 nat (DMZ,outside) static interface service tcp https https 
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_acl in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL 
aaa authentication serial console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication enable console LOCAL 
aaa authorization command LOCAL 
aaa authorization exec LOCAL 
http server enable
http 192.168.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.3.1,CN=MyASA
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.3.0 255.255.255.0 inside
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group labzGroup request dialout pppoe
vpdn group labzGroup localname samandrew@telco-isp.net
vpdn group labzGroup ppp authentication chap
vpdn username samandrew@telco-isp.net password ***** store-local

dhcpd dns 1.1.1.1 8.8.8.8
dhcpd domain labz.local
!
dhcpd address 192.168.3.30-192.168.3.90 inside
dhcpd dns 1.1.1.1 8.8.8.8 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
username DrewAdmin password fZC8u8Iqk7W4q1hs encrypted privilege 15
username DrewAdmin attributes
 service-type admin
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active   
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:f38de6f9c4834dee452b30e10f54a8de
: end
MyASA#  

Here is my 1st packet-trace:

MyASA# packet-tracer input outside tcp 8.8.8.8 443 172.16.0.2 443 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in   172.16.0.0      255.255.255.0   DMZ

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: DROP
Config: 
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0xcd2ec2d0, priority=11, domain=permit, deny=true
    hits=32828, user_data=0x5, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

UPDATE (Feb 26th): I removed all ACLs and added the ones suggested, but HTTP/HTTPS traffic is still not getting through, unfortunately. My new Show Run:

MyASA# show running-config
: Saved
:
: Serial Number: 
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.2(3)
!
hostname MyASA
domain-name Labz.local
enable password encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 description Labz LAN
 nameif inside
 security-level 100
 ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
 description Telco-ISP 100 Mbps fiber
 nameif outside
 security-level 0
 pppoe client vpdn group LabzGroup
 ip address pppoe setroute
!
interface Vlan12
 description DMZ port
 no forward interface Vlan1
 nameif DMZ
 security-level 50
 ip address 172.16.0.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
 domain-name Labz.local
same-security-traffic permit inter-interface
object network show
object network dmz-subnet
 subnet 172.16.0.0 255.255.255.0
object network webserver
 host 172.16.0.2
object network webserver-80
 host 172.16.0.2
object-group icmp-type PING-both
 description PING echo & echo-reply
 icmp-object echo
 icmp-object echo-reply
access-list outside_acl extended permit tcp any object webserver eq https
access-list outside_acl extended permit tcp any object webserver eq www
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo-reply outside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network dmz-subnet
 nat (DMZ,outside) dynamic interface
object network webserver
 nat (DMZ,outside) static interface service tcp https https
object network webserver-80
 nat (DMZ,outside) static interface service tcp www www
!
nat (any,outside) after-auto source dynamic any interface
nat (inside,outside) after-auto source dynamic any interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
aaa authorization exec LOCAL
http server enable
http 192.168.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.3.1,CN=MyASA
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
 certificate e8fbb45b
    bf03b569 694aeba7 03c36099 8d
  quit
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.3.0 255.255.255.0 inside
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group LabzGroup request dialout pppoe
vpdn group LabzGroup localname MrCustomer@Telco-ISP.net
vpdn group LabzGroup ppp authentication chap
vpdn username MrCustomer@Telco-ISP.net password ********* store-local

dhcpd dns 1.1.1.1 8.8.8.8
dhcpd domain Labz.local
!
dhcpd address 192.168.3.30-192.168.3.90 inside
dhcpd dns 1.1.1.1 8.8.8.8 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
username AdminMe password encrypted privilege 15
username AdminMe attributes
 service-type admin
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:139e5552c3c8346de7d6b388e72ee8bb
: end
MyASA#

My second packet trace attempt:

MyASA# packet-tracer input outside tcp 8.8.8.8 443 172.16.0.2 443 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in   172.16.0.0      255.255.255.0   DMZ

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc34e810, priority=0, domain=nat-per-session, deny=false
        hits=260315, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcd251fe8, priority=0, domain=permit, deny=true
        hits=110764, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

MyASA#

Also, here are my ACLs (Feb 26th):

MyASA(config)# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list outside_acl; 2 elements; name hash: 0x6b8df462
access-list outside_acl line 1 extended permit tcp any object webserver eq https (hitcnt=0) 0xf582ebb0
  access-list outside_acl line 1 extended permit tcp any host 172.16.0.2 eq https (hitcnt=0) 0xf582ebb0
access-list outside_acl line 2 extended permit tcp any object webserver eq www (hitcnt=0) 0x0e174c0d
  access-list outside_acl line 2 extended permit tcp any host 172.16.0.2 eq www (hitcnt=0) 0x0e174c0d

Update, Feb 27th - Here is my 3rd Show Run

MyASA(config)# show run
: Saved
:
: Serial Number:
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.2(3)
!
hostname MyASA
domain-name labz.local
enable password lE85y9xDQeSE5Ktl encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 description labz LAN
 nameif inside
 security-level 100
 ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
 description Telco-ISP 100 Mbps fiber
 nameif outside
 security-level 0
 pppoe client vpdn group labzGroup
 ip address pppoe setroute
!
interface Vlan12
 description DMZ port
 no forward interface Vlan1
 nameif DMZ
 security-level 50
 ip address 172.16.0.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
 domain-name labz.local
same-security-traffic permit inter-interface
object network show
object network dmz-subnet
 subnet 172.16.0.0 255.255.255.0
object network webserver
 host 172.16.0.2
object network webserver-80
 host 172.16.0.2
object-group icmp-type PING-both
 description PING echo & echo-reply
 icmp-object echo
 icmp-object echo-reply
access-list outside_acl extended permit tcp any object webserver eq https
access-list outside_acl extended permit tcp any object webserver eq www
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo-reply outside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network webserver
 nat (DMZ,outside) static interface service tcp https https
object network webserver-80
 nat (DMZ,outside) static interface service tcp www www
!
nat (inside,outside) after-auto source dynamic any interface
nat (DMZ,outside) after-auto source dynamic any interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
aaa authorization exec LOCAL
http server enable 444
http 192.168.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.3.1,CN=MyASA
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
 certificate e8fbb45b
    bf03b569 694aeba7 03c36099 8d
  quit
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.3.0 255.255.255.0 inside
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group labzGroup request dialout pppoe
vpdn group labzGroup localname fryandrew@Telco-ISP.net
vpdn group labzGroup ppp authentication chap
vpdn username fryandrew@Telco-ISP.net password ***** store-local

dhcpd dns 1.1.1.1 8.8.8.8
dhcpd domain labz.local
!
dhcpd address 192.168.3.30-192.168.3.90 inside
dhcpd dns 1.1.1.1 8.8.8.8 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
username AdminMe password fZC8u8Iqk7W4q1hs encrypted privilege 15
username AdminMe attributes
 service-type admin
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:9baa3a68f21c745a705eafb83ad44b86
: end
MyASA(config)#

Here is the updated packet trace:

MyASA# packet-tracer input outside tcp 8.8.8.8 80 172.16.0.2 80 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in   172.16.0.0      255.255.255.0   DMZ

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc34e810, priority=0, domain=nat-per-session, deny=false
    hits=379567, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=any, output_ifc=any

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP  
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcd251fe8, priority=0, domain=permit, deny=true
    hits=197361, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Here are my ACLs (Feb 27th):

    MyASA# show access-list 
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list outside_acl; 2 elements; name hash: 0x6b8df462
access-list outside_acl line 1 extended permit tcp any object webserver eq https (hitcnt=0) 0xf582ebb0 
  access-list outside_acl line 1 extended permit tcp any host 172.16.0.2 eq https (hitcnt=0) 0xf582ebb0 
access-list outside_acl line 2 extended permit tcp any object webserver eq www (hitcnt=0) 0x0e174c0d 
  access-list outside_acl line 2 extended permit tcp any host 172.16.0.2 eq www (hitcnt=0) 0x0e174c0d 

Edit - looks like I have a redundant NAT statement/policy...? (This did not matter in the end)

MyASA# show NAT detail 

Auto NAT Policies (Section 2)
1 (DMZ) to (outside) source static webserver interface   service tcp https https 
    translate_hits = 0, untranslate_hits = 148
    Source - Origin: 172.16.0.2/32, Translated: Current_Pub_IP/32
    Service - Protocol: tcp Real: https Mapped: https 
2 (DMZ) to (outside) source static webserver-80 interface   service tcp www www 
    translate_hits = 0, untranslate_hits = 102
    Source - Origin: 172.16.0.2/32, Translated: Current_Pub_IP/32
    Service - Protocol: tcp Real: www Mapped: www 

Manual NAT Policies (Section 3)
1 (inside) to (outside) source dynamic any interface  
    translate_hits = 52506, untranslate_hits = 12737
    Source - Origin: 0.0.0.0/0, Translated: Current_Pub_IP/32
2 (DMZ) to (outside) source dynamic any interface  
    translate_hits = 1142, untranslate_hits = 4
    Source - Origin: 0.0.0.0/0, Translated: Current_Pub_IP/32
  • 3
    You have issued packet tracer sourced from DMZ zone with IP source 8.8.8.8, as per your configuration it should be host within 172.16.0.0/24 than destination IP should be 8.8.8.8. If you would like to test from outside to inside interface should be outside. packet-tracer input outside tcp 8.8.8.8 443 172.16.0.2 443 detailed – Datagram.Network Feb 20 at 14:15
  • 3
    host 0.0.0.0 does not mean any. – Ricky Beam Feb 20 at 16:56
  • Thank you both. I have updated my post with the corrected packet-trace. – SamAndrew81 Feb 21 at 2:05
5
+50
access-list outside_acl extended permit tcp interface outside object webserver eq https 
access-list outside_acl extended permit tcp interface outside object webserver eq www 
access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq www 
access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq https

You need to remove all of those lines above, by issuing the commands:

no access-list outside_acl extended permit tcp interface outside object webserver eq https 
no access-list outside_acl extended permit tcp interface outside object webserver eq www 
no access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq www 
no access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq https

They are doing nothing, essentially. Your existing rules are restricting the source (i.e., the person on the internet) to your IP addresses (not theirs).

If you want to permit traffic coming from the internet to your web-server, you need to replace the lines you just deleted with:

access-list outside_acl extended permit tcp any object webserver eq https

Your current object NAT statement is only allowing for the use of HTTPS (not HTTP), so if you want to include HTTP as well, we will need to make a separate statement for it, which can be done like:

object network webserver-80
 host 172.16.0.2
 nat (DMZ,outside) static interface service tcp www www

Now that you've added a NAT for HTTP, we can add a supporting ACE for allowing HTTP, by adding:

access-list outside_acl extended permit tcp any object webserver eq www

Edit:

I didn't notice before that you have a redundant global NAT for the DMZ interface, that's being hit before your PAT statements, causing them not to be used. Also, since you're using the interface IP and for port 443, which is currently bound to the internal web server of the ASA for ASDM, you need to move it off to another port so there is no conflict.

Please change the http server's port by issuing:

no http server enable
http server enable 444

Make note of this non-standard port, as this is what you will need to use in order to access ASDM if you use it at all. Instead of just https://192.168.3.1 it will now be https://192.168.3.1:444

Please remove:

object network dmz-subnet
 nat (DMZ,outside) dynamic interface

By issuing:

object network dmz-subnet
 no nat (DMZ,outside) dynamic interface

Also, you have another global NAT that is set to use "any" interface, which is not recommended. My suggestion is to change it to restrict it to the only remaining interface without an explicit NAT (the DMZ interface) by issuing:

no nat (any,outside) after-auto source dynamic any interface

nat (DMZ,outside) after-auto source dynamic any interface

Edit (adding from comment discussions):

Also, your outside interface does not have an ACL bound to it.

Please add:

access-group outside_acl in interface outside
  • Jesse, when you have a moment, what would you say was my problem here, in a nutshell? I'm at roughly the CCENT level and am almost ready to take ICND2 200-105 and get my CCNA, but guess I'm still struggling with understanding NAT/PAT. – SamAndrew81 Feb 28 at 5:30
  • 1
    @SamAndrew81 Nothing major. Just that your ACL entries were using all private IPs in the source and destination field, which doesn't work for internet traffic, your NAT/PAT statements were out of order (not necessarily wrong), and there was no ACL tied to the outside interface. All pretty common issues, really. – Jesse P. Feb 28 at 5:39
  • 1
    @SamAndrew81 If you had a couple of IP addresses to use instead of just a single IP address from your ISP, this would have been simpler to solve, but much of what I had you do would still have been needed. – Jesse P. Feb 28 at 5:41
  • Good to hear, thank you again. I had been stuck on this for months, no kidding! – SamAndrew81 Feb 28 at 5:49
  • 1
    @SamAndrew81 I saw. That's partly why I picked it up. Glad I could help and that it's finally solved. Good luck with your certs. – Jesse P. Feb 28 at 5:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.