DMZ Setup Advise

So if I wanted to restrict access from one of my local LANs to the DMZ would I use an ACL like:

access-list dmz_in extended permit ip 10.229.24.0 255.255.255.0 host 172.16.1.1

access-group dmz_in in

Or would I do a static trans like:

static (inside, dmz) 10.229.24.0 172.16.1.1

to restrict access the best way would be to use the ACL

Medassurant,

Could you give me an example with the config I attached earlier. I want to create an ACL that will allow only 10.229.24.0 subnet to talk to the DMZ servers but no one else on my local LAN. I'm a little confused as to what interfaces I would apply the acls to. If I apply it to my inside "in" interface, I don't want it interferring with my other users going out to the internet , etc.

Thanks for your help!

If I'm reading this right you're applying this ACL to block all traffic going to a host on my DMZ from the local LAN:
access-list inside extended line 1 deny tcp any host 172.16.1.10 eq 1433
access-list inside extended line 2 permit ip any any log


And... this rule (static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0) is  allowing the 10.1.1.0 subnet to talk to all host on the DMZ while still restricting access on the other acl?


 

(static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0) is not a rule is a nat statement which says to keep 10.1.1.0 network addresses the same when they are going to the dmz interface. The config I gave is a nice example of what is required, my inside acl only denies access to 172.16.1.12  over port 1433 but it could read

access-list inside extended line 1 deny ip any host 172.16.1.10 log

which would deny all  traffic from behind the inside interface to that dmz host.

Sorry wrote that to quickly I meant the acl denies port 1433 access to 172.16.1.10

to deny all access to that host

use access-list inside extended line 1 deny ip any host 172.16.1.10 log

or all host on the dmz

access-list inside extended line 1 deny ip any 172.16.1.0 255.255.255.0 log

Okay,

So for my current situation I would do this:


static (dmz,outside) 205.154.1.1 171.16.1.10 netmask 255.255.255.255
static (inside,dmz) 10.229.24.0 10.229.24.0 netmask 255.255.255.0
static (inside,dmz) 10.101.30.0 10.101.30.0 netmask 255.255.255.0

access-list out_in extended permit tcp any host 205.154.1.1 eq 80
access-list dmz_in extended permit tcp host 172.16.1.10 any eq 80

access-group out_in in outside
access-group dmz_in in dmz

Now would I need an acl for my inside interface since I have the nat statements in place? From a security stand point - would this be an effective way of doing it to protect my inside LAN?
 

you have to have an acl on the inside interface even if its an any any, the outside and dmz acls and a inside acl work togather to protect the inside networks.

So the example config I posted looks good other than the inside interface acl?

yep, use the inside acl to restrict access to the dmz, and any other access to the outside that you require.

I kind of had one setup for certain ports outbound already but disabled it. Check out this acl and let me know what you think for my inside in acl:

access-list inside_out extended permit tcp host 10.229.24.110 any
access-list inside_out extended permit tcp host 10.229.26.19 any
access-list inside_out extended permit tcp 10.229.24.0 255.255.0.0  172.16.1.10 eq 80
access-list inside_out extended permit tcp 10.101.30.0 255.255.0.0  172.16.1.10 eq 80
access-list inside_out extended permit tcp 10.101.0.0 255.255.0.0 any object-group tcp-inside-out-ports
access-list inside_out extended permit tcp 10.229.0.0 255.255.0.0 any object-group tcp-inside-out-ports
access-list inside_out extended permit tcp 192.168.100.0 255.255.255.0 any object-group tcp-inside-out-ports
access-list inside_out extended permit udp 10.101.0.0 255.255.0.0 any object-group udp-inside-out-ports
access-list inside_out extended permit udp 10.229.0.0 255.255.0.0 any object-group udp-inside-out-ports
access-list inside_out extended permit udp 192.168.100.0 255.255.255.0 any object-group udp-inside-out-ports
access-list inside_out extended permit tcp host 10.229.24.62 any eq smtp
access-list inside_out extended permit icmp any any echo
access-list inside_out extended permit ip 10.101.0.0 255.255.0.0 192.168.105.0 255.255.255.0
access-list inside_out extended permit ip 10.229.0.0 255.255.0.0 192.168.105.0 255.255.255.0
access-list inside_out extended deny ip any any log

object-group service tcp-inside-out-ports tcp
 port-object eq https
 port-object eq www
 port-object eq domain
 port-object eq ftp
 port-object eq pop3
 port-object eq 123
 port-object eq 3389
 port-object eq 4443
 port-object eq 8080
 port-object eq 8250
 port-object eq 33
port-object eq 7880
object-group service udp-inside-out-ports udp
 port-object eq domain
 port-object eq ntp
 port-object eq tftp
 port-object range 33434 33535

The rules look fine, What I would do is implement the acl with a ip any any log rule at the bottom which will catch any mistakes that you have made with your permits, let it sit there for a day and look at the log for any issues.

Then make your changes to the acl and remove the ip any any

This is what I tried on my ASA and I can't ping it from my workstation on the 10.229.24.0 LAN. Here is what I applied for testing purposes:

access-list inside_in extended permit ip any any log
access-group inside_in in interface inside

access-list dmz_in extended permit ip any any log
access-group dmz_in in interface dmz

static (inside,dmz) 10.229.24.0 10.229.24.0 netmask 255.255.255.0
static (dmz,inside) 172.16.1.0 172.16.1.0 netmask 255.255.255.0

I can ping 172.16.1.253 ( the switch connected to the DMZ interface) from the ASA but that's about it.

You cant ping your asa or a host in the dmz ? By the default you cant ping the ASA's interfaces

A host on the dmz. From the Asa I can ping 172.16.1.253 but I can't from a host on the 10.229.24.0 LAN.

Think I figured it out, I added:

global (dmz) 1 interface

nat (dmz) 1 172.16.1.0 255.255.255.0

Now I can ping the host inside the dmz :)

excellant

Quick question though, I originally added:
global (outside) 1 interface
nat (dmz) 1 172.16.1.0 255.255.255.0

why wouldn't this work since I want the dmz to be able to go out to the Internet? Why did I have to add the global (dmz) 1 interface statement in order for it to work?

the global nat, just give the  dmz a nat ip address when they are not going to the inside, if you ping from the asa you still required a nat statement to reach everything else. in your first config you only defined the nate statement for reaching from the dmz to the inside

The asa by default require nat whenever traversing from one interface to another,  it is  nat-control feature.

Should I do global (dmz) 2 interface or leave it as is?

You will also need a global for the inside network  to the outside

Sorry, I meant to do this:
global (inside) 1 interface
global (dmz) 2 interface

does it matter that I have (1) for both like this:
global (inside) 1 interface
global (dmz) 1 interface

they can both use the same global

ex.

global (OUTSIDE) 1 interface
nat (CORPORATE_SERVERS) 1 192.168.99.0 255.255.255.0
nat (inside) 1 192.168.98.11 255.255.255.255

Cool. Thanks for all your help. One last question:

Instead of doing acls to restrict access can I do something like this:

static (inside,dmz) tcp 10.229.24.0 80 172.16.1.10 80
static (dmz,inside) tcp 172.16.1.10 80 10.229.24.0 80

I'm just worried about applying an acl to my inside interface. I applied it a few weeks back and I got tons of calls about people not being to get to certain websites, databases etc. What do you recommend in this situation? It was pretty much that acl example I posted earlier.

Use the acl  make it an ip any any  at first then add more statements to it as you get better at determining what traffic you dont want people to reach on your dmz.  When you have time setup a syslog server and send the logs from the asa to it and you can see all of your traffic hitting the acls, this will give you a good picture of what is going throug your firewall and let you set up the appropriate rules.

But a rule that logs the inside traffic will at least give you the ability to track traffic that goes through the firewall but do what you can do.

I was referring to my users going out to my internet. When I applied the acl in my inside interface I had many complaints about not being able to hit certain websites and databases. So you're saying to still add permit ip any any log and monitor the traffic for a few days and create a list of appropriate port to allow?

yep

I tried blocking myself from being able to ping the host in the dmz by doing this:

access-list dmz_in extended deny tcp host 172.16.1.253 any

and I also tried

access-list dmz_in extended deny tcp any host 172.16.1.253

access-group dmz_in in interface dmz

and I can still ping 172.16.1.253  -  what am I doing wrong?

you have to put the deny on the inside interface

access-list inside_in extended deny ip any host 172.16.1.253

Thanks for all your help on this. I think I'm going to close it so I can stop bugging you. :)

Have a good night and thanks again for your help!