Solved

Cisco ASA ACL

Posted on 2011-03-16
4
737 Views
Last Modified: 2012-05-11
I have some "Internal" servers 192.x.x.x trying to telnet to a "DMZ" server 172.x.x.x on port 27000 and connection keeps failing. What access list rule via ASDM or CLI should I insert to get this working.
0
Comment
Question by:solarisjunkie
  • 3
4 Comments
 
LVL 1

Expert Comment

by:slamjam2000
ID: 35153687
!(Inside server)192.168.1.10 --> 172.20.1.20 (DMZ server)

!defining acl with interface

access-group DMZtoInside in interface DMZ
access-group InsidetoDMZ in interface inside


!example of static NAT

static (inside,DMZ) 172.20.1.5 192.168.2.20 netmask 255.255.255.255

!DMZ back to Inside server
access-list DMZtoInside permit tcp host 172.20.1.20 host 172.20.1.5 eq 27000

!inside server access to DMZ
access-list InsidetoDMZ permit tcp host 192.168.1.10 host 192.168.2.20 eq 27000
0
 
LVL 1

Accepted Solution

by:
slamjam2000 earned 500 total points
ID: 35153703
Oop... I missed something on my last post.. sorry...  here it is..

!Example Path: (Inside server)192.168.1.10 --> 172.20.1.20 (DMZ server)

!defining acl with interface
access-group DMZtoInside in interface DMZ
access-group InsidetoDMZ in interface inside


!example of static NAT

static (inside,DMZ) 172.20.1.5 192.168.1.10 netmask 255.255.255.255
static (DMZ,inside) 192.168.1.20 172.20.1.20 netmask 255.255.255.255


!inside server access to DMZ
access-list InsidetoDMZ permit tcp host 192.168.1.10 host 192.168.2.20 eq 27000

!DMZ back to Inside server
access-list DMZtoInside permit tcp host 172.20.1.20 host 172.20.1.5 eq 27000

0
 

Author Comment

by:solarisjunkie
ID: 35155422
If the internal servers are a subnet 192.x.x.0/24 how do I
adjust the ACL accordingly
0
 
LVL 1

Expert Comment

by:slamjam2000
ID: 35162256
You will need to adjust both the NAT and ACL to the /24 subnet for both DMZ and Inside.

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

896 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now