internal access to DMZ outside IP's

[Daniel2040]

Hi,

I have a 515e and 2x web servers on DMZ on 30.30.30.1 & .2
I have a LAN with NAT on 192.168.0.xxx

I have mapped 2x external WAN address's 213.xxx.xxx.35 & 36 to the 2x Web servers.

When i go to 213.xxx.xxx.35 or 36 from the LAN i cannot see the web servers. Can anyone advise.

Kind regards,

Daniel.

 

[BAsh12]

What does you r access list read?

Post the config, should be easy to sort.

 

[Daniel2040]

PIX Version 8.0(3)
!
interface Ethernet0
nameif outside
security-level 0
ip address 213.xxx.xxx.25 255.255.255.248
ospf cost 10
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.0.200 255.255.255.0
ospf cost 10
!
interface Ethernet2
nameif DMZ
security-level 50
ip address 30.30.30.100 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list outside_access_in extended permit tcp any host 213.xxx.xxx.26 eq www
access-list outside_access_in extended permit tcp any host 213.xxx.xxx.27 eq www
access-list inside_access_in extended permit tcp any host 213.xxx.xxx.26 eq www
access-list inside_access_in extended permit tcp any host 213.xxx.xxx.27 eq www
access-list inside_access_in extended permit object-group TCPUDP any any eq www
access-list inside_access_in extended permit object-group TCPUDP any any eq domain
access-list inside_access_in extended permit tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq pop3
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.128
access-list inside_access_out extended permit tcp any any eq smtp
access-list inside_access_out extended permit tcp any any eq pop3
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
asdm image flash:/asdm-603.bin
arp timeout 14400
global (outside) 101 213.xxx.xxx.28-213.xxx.xxx.29 netmask 255.255.255.248
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0
static (DMZ,outside) 213.xxx.xxx.26 30.30.30.201 netmask 255.255.255.255
static (DMZ,outside) 213.xxx.xxx.27 30.30.30.202 netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
route outside 0.0.0.0 0.0.0.0 213.xxx.xxx.30 1

 

[BAsh12]

Try this:-

object-group network all-subnets
network-object 0.0.0.0 0.0.0.0

object-group network dmz-www
network-object host 30.30.30.1
network-object host 30.30.30.2

object-group service

http://www tcp

service-object eq www


access-list dmz permit tcp object-group all-subnets object-group dmz-

http://www object-group

www


access-group dmz in interface dmz

Let me know if it works, should do.

I always use object groups, makes it much easier.

When you put the rule in you can see exactly what it is doing.

do a sh access-list dmz and you will see what I mean.

 

[Daniel2040]

thanks for your help

when i use the command network-object i get :

Result of the command: "network-object 0.0.0.0 0.0.0.0"

network-object 0.0.0.0 0.0.0.0
^
ERROR: % Invalid input detected at '^' marker.

 

[BAsh12]

Does it take the object-network all-subnets?

 

[Daniel2040]

yes it does

 

[BAsh12]

This command needs to be under the

object-group network all-subnets
network-object 0.0.0.0 0.0.0.0

Copy and paste the above.

 

[Daniel2040]

Thanks, it works fine up until:

Result of the command: "object-group service

http://www tcp"

The command has been sent to the device


Result of the command: "service-object eq www"

service-object eq www
^
ERROR: % Invalid input detected at '^' marker.

 

[BAsh12]

Sorry

Half asleep


object-group service

http://www tcp

port-object eq www

 

[BAsh12]

By the way, I do not use the ASDM so may make it a bit harder for you if you are.

 

[Daniel2040]

thank you for all your help.
It has accepted all the commands but from a LAN client on the network 'Inside' i still cannot see the DMZ



Kind regards,

Daniel.

 

[BAsh12]

Ah I think I see what you want to do.

Your inside address is on 192.168.xxx.xxx address, all you inside statements are pointing to the outside.

Do you want inside users to only be able to access

http://www on

the DMZ?

Are you bothered if they are natted?

If you are not worried about that the you can do a no-nat from the inside to the DMZ.

Would that help?

 

[Daniel2040]

i only need the 'inside' interface to access

http://www on

the 2 web servers on the 'DMZ' interface.

Would the no-nat be more secure for the inside interface?

 

[BAsh12]

You have this:-


access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.128

What is the last bit doing by the way, 192.168.0.0 255.255.255.128? is this your VPN clients?

 

[Daniel2040]

yes they are the VPN clients.

 

[BAsh12]

You have this:-


access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.128

try changing it to this, do not remove it yet because you can put it back any time.



object-group network dmz-www
network-object host 30.30.30.1
network-object host 30.30.30.2

object-group service

http://www tcp

port-object eq www


object-group network no-nat
network-object 192.168.0.0 255.255.255.0


object-group network local-lan
network-object 192.168.0.0 255.255.255.0

object-group network vpn-client
network-object 192.168.0.0 255.255.255.128


access-list dmz permit tcp object-group local-lan object-group dmz-

http://www object-group

www
access-group dmz in interface dmz

access-list nonat permit ip object-group local-lan object-group dmz-www
access-list nonat permit ip object-group local-lan object-group vpn-client
no nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 0 access-list nonat





If the above does not work, which it should, just copy and paste what is below:-

no nat (inside) 0 access-list nonat
nat (inside) 0 access-list inside_nat0_outbound

 

[Daniel2040]

sorry to be a pain.
I have tried both of the above and still nothing

 

[BAsh12]

have you removed everything we tried?

 

[BAsh12]

got to be carefull of the access-list order.

Would be easier if we convert all the access-list to use object-groups.