Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

High range ports and ASA inspection ?

Posted on 2010-11-10
7
Medium Priority
?
528 Views
Last Modified: 2012-05-10
We have an ASA5505 with inside, dmz and outside interface. I cannot get outside connections to come in.

We normally allow outside traffic into the dmz like this: (ip addresses have been changed)

access-list outside-in extended permit tcp any host 77.1.1.80 eq 80
access-list outside-in extended permit tcp any host 77.1.1.80 range 60000 64999
static (dmz,outside) 77.1.1.80  10.10.10.12 netmask 255.255.255.255

All DMZ hosts have full access to anything (except internal network)

The issue we are having is, no traffic is hitting 10.10.10.12 from the outside. I even did a permit ip any host 77.1.1.80 and still nothing.  If we access 77.1.1.80  from 77.1.1.50,(one of our own public IPs) it works. But no other outside users can access it
0
Comment
Question by:orus
  • 4
  • 2
7 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 1000 total points
ID: 34104069
did you apply the outside-in acl with an access-group command?

ASA setting up a DMZ http://www.petenetlive.com/KB/Article/0000316.htm

Pete

0
 

Author Comment

by:orus
ID: 34104399
Yes
0
 

Author Comment

by:orus
ID: 34104523
I have several other dmz boxes that are accessed no problem
0
Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

 
LVL 10

Expert Comment

by:stsonline
ID: 34105441
Try putting a capture on the outside and DMZ interfaces then try to send traffic - you may be getting data on the wrong ports. Have you checked the logs to see if anything is being denied?
0
 

Author Comment

by:orus
ID: 34105841
I did do a capture earlier. I can see the DMZ host sending traffic out
I see it translated to the public IP
I see TCP syns going out , but no other TCP traffic

On the ACLS:

I see no hits on the ACL , EXCEPT for when host 77.1.1.50 accessed it. Then it worked. But any host outside of our public IP block does NOT work. I thought it could be a routing issue with our Cable internet provider.  (not sending traffic destined for 77.1.1.80 to our modem)?
0
 
LVL 10

Assisted Solution

by:stsonline
stsonline earned 1000 total points
ID: 34106400
Try putting a capture on the outside interface grabbing 77.1.1.80 as the source or destination, then try to open http://77.1.1.80 from somewhere other than your 77.1.1.x systems. If you still aren't seeing anything then the issue is probably on your ISP and/or modem.

Is 77.1.1.80 the IP address of your outside interface?
0
 

Author Comment

by:orus
ID: 34106712
Yea I tried that too. And just now, I tried allowing VNC in through to a dmz host. It worked like a charm.  This Lifesize video conferencing device is the one with the issue. It doesn't like being behind Cisco firewalls I heard. oh well
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question