troubleshooting Question

ASA 5505 (8.3.1) DMZ access to outside

Avatar of charlietaylor
charlietaylor asked on
CiscoHardware Firewalls
10 Comments1 Solution1257 ViewsLast Modified:
I have a 5505 that has a BASE license and had it communicating with VPN (INSIDE) interface and now need Internet access only. I had no issue getting the DMZ communicating with far side VPN but now can not get to talk to OUTSIDE. I am not getting any errors in the log (shows to be building up and tearing down correctly)

I can put the "access-group dmz in interface dmz" command line in and get errors in log that show "DENY by access-group dmz"

any expert suggestions? (see condensed config below)


!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.73.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 69.15.200.138 255.255.255.252
!
interface Vlan5
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/7
 switchport access vlan 5
!
boot system disk0:/asa831-k8.bin
!
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network 192.168.72.0
 subnet 192.168.72.0 255.255.255.0
 description Sixpines  
object network NETWORK_OBJ_192.168.73.0_24
 subnet 192.168.73.0 255.255.255.0
object network obj-192.168.73.0
 subnet 192.168.73.0 255.255.255.0
object network Sixpines
 subnet 192.168.72.0 255.255.255.0
object network DMZ
 subnet 192.168.1.0 255.255.255.0
object-group network SixpinesInternalNetwork
 network-object Sixpines 255.255.255.0
access-list DMZ_access_in extended permit ip any any inactive
access-list DMZ_access_in extended permit ip object DMZ object obj_any inactive
access-list outside_1_cryptomap extended permit ip object obj-192.168.73.0 object Sixpines
access-list dmz extended permit ip object obj_any object DMZ
!
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
nat (inside,any) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (inside,outside) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (dmz,outside) source static DMZ DMZ
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 69.15.200.137 1


ASKER CERTIFIED SOLUTION
ullas_unni

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 10 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 10 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros