[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 610
  • Last Modified:

ASA 5510 DMS IP addresses not seeing the public

We are repacing our PIX 515e wit a ASA 5501 and after converting the configuration over I can not see the public from the dmz (10.0.100.0) when ping either by name or ip address. From the inside (10.0.200.0) I can get to the public by name or ip address. Can anyone look at my configuration and tell me what I missed?

Thanks,
Steve
0
sekoon
Asked:
sekoon
  • 4
  • 3
1 Solution
 
sekoonAuthor Commented:
Here is the current ASA configuration

: Saved
:
ASA Version 8.2(1)
!
hostname Escape-Inap-ASA-1
domain-name escapia.com
enable password ????????? encrypted
passwd ???????? encrypted
names
name 10.0.100.22 WPool1HostA_DMZ
name 10.0.100.0 DMZ
name 10.0.100.65 WPool1NLB_DMZ
name 10.0.200.0 PRIVATE
!
interface Ethernet0/0
 speed 100
 duplex full
 nameif outside
 security-level 0
 ip address 69.25.129.6 255.255.255.128
!
interface Ethernet0/1
 speed 100
 duplex full
 nameif dmz
 security-level 50
 ip address 10.0.100.1 255.255.255.0
!
interface Ethernet0/2
 speed 100
 duplex full
 nameif inside
 security-level 100
 ip address 10.0.200.1 255.255.255.0
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name escapia.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service MicrosoftSMB tcp
 port-object range 137 netbios-ssn
 port-object eq netbios-ssn
 port-object eq 445
object-group service MMS-RTSP tcp
 description Windows Media Server
 port-object eq 1755
 port-object eq rtsp
object-group service MMS-RTSP-UDP udp
 description Windows Media Server
 port-object eq 1755
 port-object eq 5005
object-group service MMS-OUT udp
 description Windows Media Server
 port-object range 1024 5000
object-group network WEB-HOSTS
 network-object 10.0.100.10 255.255.255.255
 network-object WPool1HostA_DMZ 255.255.255.255
 network-object WPool1NLB_DMZ 255.255.255.255
 network-object 10.0.100.24 255.255.255.255
 network-object 10.0.100.100 255.255.255.255
 network-object 10.0.100.101 255.255.255.255
 network-object 10.0.100.102 255.255.255.255
 network-object 10.0.100.103 255.255.255.255
 network-object 10.0.100.121 255.255.255.255
 network-object 10.0.100.122 255.255.255.255
 network-object 10.0.100.123 255.255.255.255
 network-object 10.0.100.80 255.255.255.255
 network-object 10.0.100.2 255.255.255.255
 network-object 10.0.100.44 255.255.255.255
 network-object 10.0.100.90 255.255.255.255
 network-object 10.0.100.30 255.255.255.255
 network-object 10.0.100.33 255.255.255.255
 network-object 10.0.100.37 255.255.255.255
 network-object 10.0.100.34 255.255.255.255
 network-object 10.0.100.38 255.255.255.255
 network-object 10.0.100.39 255.255.255.255
 network-object 10.0.100.84 255.255.255.255
 network-object 10.0.100.50 255.255.255.255
 network-object 10.0.100.61 255.255.255.255
 network-object 10.0.100.62 255.255.255.255
 network-object 10.0.100.64 255.255.255.255
 network-object 10.0.100.66 255.255.255.255
 network-object 10.0.100.67 255.255.255.255
 network-object 10.0.100.68 255.255.255.255
 network-object 10.0.100.69 255.255.255.255
 network-object 10.0.100.70 255.255.255.255
 network-object 10.0.100.32 255.255.255.255
 network-object 10.0.100.35 255.255.255.255
 network-object 10.0.100.36 255.255.255.255
 network-object 10.0.100.52 255.255.255.255
 network-object 10.0.100.59 255.255.255.255
object-group service WEB-SERVICES tcp
 port-object eq www
 port-object eq https
object-group network WEB-HOSTS_ref
 network-object 69.25.129.44 255.255.255.255
 network-object 69.25.129.10 255.255.255.255
 network-object 69.25.129.22 255.255.255.255
 network-object 69.25.129.65 255.255.255.255
 network-object 69.25.129.24 255.255.255.255
 network-object 69.25.129.100 255.255.255.255
 network-object 69.25.129.101 255.255.255.255
 network-object 69.25.129.102 255.255.255.255
 network-object 69.25.129.103 255.255.255.255
 network-object 69.25.129.121 255.255.255.255
 network-object 69.25.129.122 255.255.255.255
 network-object 69.25.129.123 255.255.255.255
 network-object 69.25.129.80 255.255.255.255
 network-object 69.25.129.2 255.255.255.255
 network-object 69.25.129.30 255.255.255.255
 network-object 69.25.129.33 255.255.255.255
 network-object 69.25.129.37 255.255.255.255
 network-object 69.25.129.34 255.255.255.255
 network-object 69.25.129.38 255.255.255.255
 network-object 69.25.129.39 255.255.255.255
 network-object 69.25.129.124 255.255.255.255
 network-object 69.25.129.84 255.255.255.255
 network-object 69.25.129.50 255.255.255.255
 network-object 69.25.129.61 255.255.255.255
 network-object 69.25.129.62 255.255.255.255
 network-object 69.25.129.64 255.255.255.255
 network-object 69.25.129.66 255.255.255.255
 network-object 69.25.129.67 255.255.255.255
 network-object 69.25.129.68 255.255.255.255
 network-object 69.25.129.69 255.255.255.255
 network-object 69.25.129.70 255.255.255.255
object-group network WEB-HOSTS1
 network-object 10.0.100.44 255.255.255.255
 network-object 10.0.100.10 255.255.255.255
 network-object WPool1HostA_DMZ 255.255.255.255
 network-object WPool1NLB_DMZ 255.255.255.255
 network-object 10.0.100.24 255.255.255.255
 network-object 10.0.100.100 255.255.255.255
 network-object 10.0.100.101 255.255.255.255
 network-object 10.0.100.102 255.255.255.255
 network-object 10.0.100.103 255.255.255.255
 network-object 10.0.100.121 255.255.255.255
 network-object 10.0.100.122 255.255.255.255
 network-object 10.0.100.123 255.255.255.255
 network-object 10.0.100.80 255.255.255.255
 network-object 10.0.100.2 255.255.255.255
 network-object 10.0.100.30 255.255.255.255
 network-object 10.0.100.33 255.255.255.255
 network-object 10.0.100.37 255.255.255.255
 network-object 10.0.100.34 255.255.255.255
 network-object 10.0.100.38 255.255.255.255
 network-object 10.0.100.39 255.255.255.255
 network-object 10.0.100.50 255.255.255.255
 network-object 10.0.100.61 255.255.255.255
 network-object 10.0.100.62 255.255.255.255
 network-object 10.0.100.64 255.255.255.255
 network-object 10.0.100.66 255.255.255.255
 network-object 10.0.100.67 255.255.255.255
 network-object 10.0.100.68 255.255.255.255
 network-object 10.0.100.69 255.255.255.255
 network-object 10.0.100.70 255.255.255.255
 network-object 10.0.100.32 255.255.255.255
 network-object 10.0.100.35 255.255.255.255
 network-object 10.0.100.36 255.255.255.255
 network-object 10.0.100.52 255.255.255.255
 network-object 10.0.100.59 255.255.255.255
access-list acl_outside extended permit tcp any any eq ssh
access-list acl_outside extended permit udp any any eq 1701
access-list acl_outside extended permit icmp any any
access-list acl_outside extended permit tcp any object-group WEB-HOSTS_ref object-group WEB-SERVICES
access-list acl_outside extended permit ip 10.0.250.0 255.255.255.0 any
access-list acl_outside extended permit tcp any host 69.25.129.90 eq 7099
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
access-list dmz_access_in extended permit ip any any
access-list dmz_access_in extended permit icmp any any
access-list INSIDE-to-DMZ extended permit ip PRIVATE 255.255.255.0 DMZ 255.255.255.0
access-list INSIDE-to-DMZ extended permit ip any 10.0.250.0 255.255.255.0
access-list otside_cryptomap_10 extended permit ip host 69.25.129.22 216.235.180.0 255.255.255.0
access-list outside_cryptomap_10 extended permit ip host 69.25.129.65 216.235.180.0 255.255.255.0
access-list outside_cryptomap_10 extended permit ip host 69.25.129.24 216.235.180.0 255.255.255.0
access-list DMZ-to-INSIDE extended permit ip DMZ 255.255.255.0 PRIVATE 255.255.255.0
access-list DMZ-to-INSIDE extended permit ip any 10.0.250.0 255.255.255.0
access-list outside_inbound_nat0_acl extended permit ip 10.0.250.0 255.255.255.0 any
pager lines 24
logging enable
logging buffered errors
mtu outside 1500
mtu dmz 1500
mtu inside 1500
ip local pool ESUPPORT 10.0.250.1-10.0.250.20
no failover
failover polltime unit 15 holdtime 45
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (outside) 0 access-list outside_inbound_nat0_acl outside
nat (dmz) 0 access-list DMZ-to-INSIDE
nat (inside) 0 access-list INSIDE-to-DMZ
nat (inside) 1 PRIVATE 255.255.255.0
static (dmz,outside) 69.25.129.65 WPool1NLB_DMZ netmask 255.255.255.255 dns
static (dmz,outside) 69.25.129.22 WPool1HostA_DMZ netmask 255.255.255.255 dns
static (dmz,outside) 69.25.129.24 10.0.100.24 netmask 255.255.255.255
static (dmz,outside) 69.25.129.80 10.0.100.80 netmask 255.255.255.255
static (dmz,outside) 69.25.129.10 10.0.100.10 netmask 255.255.255.255
static (dmz,outside) 69.25.129.100 10.0.100.100 netmask 255.255.255.255
static (dmz,outside) 69.25.129.101 10.0.100.101 netmask 255.255.255.255
static (dmz,outside) 69.25.129.102 10.0.100.102 netmask 255.255.255.255
static (dmz,outside) 69.25.129.103 10.0.100.103 netmask 255.255.255.255
static (dmz,outside) 69.25.129.121 10.0.100.121 netmask 255.255.255.255
static (dmz,outside) 69.25.129.122 10.0.100.122 netmask 255.255.255.255
static (dmz,outside) 69.25.129.123 10.0.100.123 netmask 255.255.255.255
static (dmz,outside) 69.25.129.2 10.0.100.2 netmask 255.255.255.255
static (dmz,outside) 69.25.129.44 10.0.100.44 netmask 255.255.255.255
static (dmz,outside) 69.25.129.90 10.0.100.90 netmask 255.255.255.255
static (dmz,outside) 69.25.129.30 10.0.100.30 netmask 255.255.255.255
static (dmz,outside) 69.25.129.33 10.0.100.33 netmask 255.255.255.255
static (dmz,outside) 69.25.129.37 10.0.100.37 netmask 255.255.255.255
static (dmz,outside) 69.25.129.34 10.0.100.34 netmask 255.255.255.255
static (dmz,outside) 69.25.129.38 10.0.100.38 netmask 255.255.255.255
static (dmz,outside) 69.25.129.39 10.0.100.39 netmask 255.255.255.255
static (dmz,outside) 69.25.129.84 10.0.100.84 netmask 255.255.255.255
static (dmz,outside) 69.25.129.50 10.0.100.50 netmask 255.255.255.255
static (dmz,outside) 69.25.129.62 10.0.100.62 netmask 255.255.255.255
static (dmz,outside) 69.25.129.64 10.0.100.64 netmask 255.255.255.255
static (dmz,outside) 69.25.129.66 10.0.100.66 netmask 255.255.255.255
static (dmz,outside) 69.25.129.61 10.0.100.61 netmask 255.255.255.255
static (dmz,outside) 69.25.129.67 10.0.100.67 netmask 255.255.255.255
static (dmz,outside) 69.25.129.68 10.0.100.68 netmask 255.255.255.255
static (dmz,outside) 69.25.129.69 10.0.100.69 netmask 255.255.255.255
static (dmz,outside) 69.25.129.70 10.0.100.70 netmask 255.255.255.255
static (dmz,outside) 69.25.129.35 10.0.100.35 netmask 255.255.255.255
static (dmz,outside) 69.25.129.32 10.0.100.32 netmask 255.255.255.255
static (dmz,outside) 69.25.129.36 10.0.100.36 netmask 255.255.255.255
static (dmz,outside) 69.25.129.52 10.0.100.52 netmask 255.255.255.255
static (dmz,outside) 69.25.129.59 10.0.100.59 netmask 255.255.255.255
static (dmz,outside) 69.25.129.40 10.0.100.40 netmask 255.255.255.255
access-group acl_outside in interface outside
access-group dmz_access_in in interface dmz
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 69.25.129.126 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 0.0.0.0 0.0.0.0 inside
http PRIVATE 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community ?????????
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt radius ignore-secret
crypto ipsec transform-set l2tp esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set sitescope esp-3des esp-md5-hmac
crypto ipsec transform-set sdc esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 3600
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyna 20 set pfs
crypto dynamic-map dyna 20 set transform-set ESP-3DES-MD5 ESP-3DES-SHA
crypto dynamic-map dyna 30 set pfs
crypto dynamic-map dyna 30 set transform-set ESP-3DES-MD5
crypto map mymap 10 match address outside_cryptomap_10
crypto map mymap 10 set peer 12.153.83.11
crypto map mymap 10 set transform-set sdc
crypto map mymap 65535 ipsec-isakmp dynamic dyna
crypto map mymap interface outside
crypto ca trustpoint prodca
 revocation-check crl
 enrollment url http://10.0.0.2:80//certsrv/mscep/mscep.dll
 crl configure
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 20
 authentication rsa-sig
 encryption 3des
 hash md5
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
tunnel-group DefaultL2LGroup ipsec-attributes
 trust-point prodca
tunnel-group DefaultRAGroup ipsec-attributes
 trust-point prodca
tunnel-group DefaultWEBVPNGroup ipsec-attributes
 trust-point prodca
tunnel-group 12.153.83.11 type ipsec-l2l
tunnel-group 12.153.83.11 ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 1024
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
!
service-policy global_policy global
privilege cmd level 5 mode exec command configure
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command local-host
privilege show level 3 mode exec command interface
privilege show level 5 mode exec command clock
privilege show level 3 mode exec command ip
privilege show level 5 mode exec command fragment
privilege show level 3 mode exec command isakmp
privilege show level 3 mode exec command ipsec
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpdn
privilege show level 3 mode exec command blocks
privilege show level 5 mode exec command ntp
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 5 mode configure command clock
privilege show level 5 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 5 mode configure command fragment
privilege show level 3 mode configure command isakmp
privilege show level 3 mode configure command ipsec
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command vpdn
privilege show level 5 mode configure command ntp
privilege show level 5 mode configure command privilege
prompt hostname context
Cryptochecksum:799ef08f6dd023f771e88f67ed60525b
: end
no asdm history enable

0
 
Cyclops3590Commented:
try this

nat (dmz) 1 DMZ 255.255.255.0
0
 
sekoonAuthor Commented:
Nope, still can not ping from 10.0.100.10 (DMZ) to 4.2.2.1 (Public). Ping from 10.0.200.10 (Inside) to 4.2.2.1 (Public) still work.


 
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
Cyclops3590Commented:
did you do a 'clear xlate' after entering that command.  sometimes that needs to be done as well to force updating the translation table.
0
 
sekoonAuthor Commented:
yes I did do clear xlate and tried reloading the ASA with still no luck
0
 
Cyclops3590Commented:
interesting.  you have an acl that allows everything, so that nat matching the outside global should have gotten it working.

turn on debug level logging and post what the logs say.
0
 
sudeep_mibCommented:
Hi,

In nat 0 statements you have added nat statements but you haven't added globlal statement.

add this statement it will work
*******
global (dmz) 0 10.0.100.1 255.255.255.0
global (inside) 0 10.0.200.1 255.255.255.0
********
0
 
Cyclops3590Commented:
sudeep_mib,

nat 0 is a special value.  it means to skip the translation process completely.  as such, no global 0 command is needed.
0

Featured Post

Shaping tomorrow’s technology leaders, today

The leading technology companies all recognize the growing need for gender diversity. Through its Women in IT scholarship program, WGU is working to reverse this trend by empowering more women to earn IT degrees and become tomorrow’s tech-industry leaders.  

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now