• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 530
  • Last Modified:

High range ports and ASA inspection ?

We have an ASA5505 with inside, dmz and outside interface. I cannot get outside connections to come in.

We normally allow outside traffic into the dmz like this: (ip addresses have been changed)

access-list outside-in extended permit tcp any host 77.1.1.80 eq 80
access-list outside-in extended permit tcp any host 77.1.1.80 range 60000 64999
static (dmz,outside) 77.1.1.80  10.10.10.12 netmask 255.255.255.255

All DMZ hosts have full access to anything (except internal network)

The issue we are having is, no traffic is hitting 10.10.10.12 from the outside. I even did a permit ip any host 77.1.1.80 and still nothing.  If we access 77.1.1.80  from 77.1.1.50,(one of our own public IPs) it works. But no other outside users can access it
0
orus
Asked:
orus
  • 4
  • 2
2 Solutions
 
Pete LongTechnical ConsultantCommented:
did you apply the outside-in acl with an access-group command?

ASA setting up a DMZ http://www.petenetlive.com/KB/Article/0000316.htm

Pete

0
 
orusAuthor Commented:
Yes
0
 
orusAuthor Commented:
I have several other dmz boxes that are accessed no problem
0
Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

 
stsonlineCommented:
Try putting a capture on the outside and DMZ interfaces then try to send traffic - you may be getting data on the wrong ports. Have you checked the logs to see if anything is being denied?
0
 
orusAuthor Commented:
I did do a capture earlier. I can see the DMZ host sending traffic out
I see it translated to the public IP
I see TCP syns going out , but no other TCP traffic

On the ACLS:

I see no hits on the ACL , EXCEPT for when host 77.1.1.50 accessed it. Then it worked. But any host outside of our public IP block does NOT work. I thought it could be a routing issue with our Cable internet provider.  (not sending traffic destined for 77.1.1.80 to our modem)?
0
 
stsonlineCommented:
Try putting a capture on the outside interface grabbing 77.1.1.80 as the source or destination, then try to open http://77.1.1.80 from somewhere other than your 77.1.1.x systems. If you still aren't seeing anything then the issue is probably on your ISP and/or modem.

Is 77.1.1.80 the IP address of your outside interface?
0
 
orusAuthor Commented:
Yea I tried that too. And just now, I tried allowing VNC in through to a dmz host. It worked like a charm.  This Lifesize video conferencing device is the one with the issue. It doesn't like being behind Cisco firewalls I heard. oh well
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now