0

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this:

int vlan 3
 no forward interface vlan 1
 nameif dmz
 security 50
 ip addr x.x.x.x y.y.y.y

Everything works fine. Outside can use web service from server in DMZ and inside can access external web. But inside seems to be unable to access internal server because of droped traffic at ASA - no forward interface vlan 1. I tried to apply some ACLs but it still doesn't work. Information about version of my firewall is below. Thankyou for helping me.

Cisco Adaptive Security Appliance Software Version 8.4(2)
Device Manager Version 6.4(5)
Licensed features for this platform:
Maximum Physical Interfaces       : 8              perpetual
VLANs                             : 3              DMZ Restricted
...
This platform has a Base license.

Here is configuration on ASA:

hostname ASA
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
 switchport access vlan 3
!
interface Ethernet0/3
 switchport access vlan 3
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 22.0.0.2 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 12.0.0.2 255.255.255.0
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 21.0.0.1 255.255.255.0
!
access-list OUTSIDE extended permit tcp any host 21.0.0.50 eq www
access-list OUTSIDE extended permit tcp any host 21.0.0.50 eq 443
access-list OUTSIDE extended permit tcp any host 21.0.0.51 eq ftp
access-list OUTSIDE extended permit ip any 41.0.0.0 255.255.255.0
access-list OUTSIDE extended permit ip any 42.0.0.0 255.255.255.0
access-list OUTSIDE extended permit ip any 43.0.0.0 255.255.255.0
access-list OUTSIDE extended permit ip any 44.0.0.0 255.255.255.0
access-list INSIDE extended permit tcp any 41.0.0.0 255.255.255.0 eq www
access-list INSIDE extended permit tcp any 42.0.0.0 255.255.255.0 eq www
access-list INSIDE extended permit tcp any 43.0.0.0 255.255.255.0 eq www
access-list INSIDE extended permit tcp any 44.0.0.0 255.255.255.0 eq www
access-list INSIDE extended permit tcp any 41.0.0.0 255.255.255.0 eq 443
access-list INSIDE extended permit tcp any 42.0.0.0 255.255.255.0 eq 443
access-list INSIDE extended permit tcp any 43.0.0.0 255.255.255.0 eq 443
access-list INSIDE extended permit tcp any 44.0.0.0 255.255.255.0 eq 443
!
access-group OUTSIDE in interface outside
access-group INSIDE out interface inside
Improve this question
2
  • We need to see your full config (sanitized, of course). We can't just guess where the error is.
    – Ron Trunk
    Jun 6 at 13:33
  • @RonTrunk I just posted configuration.
    – Gekko
    Jun 6 at 15:48

1 Answer 1

Reset to default
0

This is a "feature" (i.e. restriction) of the base license. To enable the ability to forward traffic to VLAN 1, you will need to upgrade your license.

Improve this answer
1
  • Correct, the ASA 5505 was originally intended for small office use, not hosting servers in a DMZ but that ability is available with the upgraded Security Plus license (which you cannot buy anymore). You can replace the firewall with a 5505 which has the Security Plus license or had it at time of sale, or a different model firewall such as 5506, 5510, 5515, 5516 etc. All will enable the ability you need, or many other brand of firewalls (Fortinet etc.). I would advise you to get a firewall that still has ongoing updates/support for improved security.
    – FrameHowitzer
    Jun 6 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.