We help IT Professionals succeed at work.
Get Started

ASA 5505 (8.3.1) DMZ access to outside

charlietaylor
on
1,252 Views
Last Modified: 2012-05-11
I have a 5505 that has a BASE license and had it communicating with VPN (INSIDE) interface and now need Internet access only. I had no issue getting the DMZ communicating with far side VPN but now can not get to talk to OUTSIDE. I am not getting any errors in the log (shows to be building up and tearing down correctly)

I can put the "access-group dmz in interface dmz" command line in and get errors in log that show "DENY by access-group dmz"

any expert suggestions? (see condensed config below)


!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.73.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 69.15.200.138 255.255.255.252
!
interface Vlan5
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/7
 switchport access vlan 5
!
boot system disk0:/asa831-k8.bin
!
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network 192.168.72.0
 subnet 192.168.72.0 255.255.255.0
 description Sixpines  
object network NETWORK_OBJ_192.168.73.0_24
 subnet 192.168.73.0 255.255.255.0
object network obj-192.168.73.0
 subnet 192.168.73.0 255.255.255.0
object network Sixpines
 subnet 192.168.72.0 255.255.255.0
object network DMZ
 subnet 192.168.1.0 255.255.255.0
object-group network SixpinesInternalNetwork
 network-object Sixpines 255.255.255.0
access-list DMZ_access_in extended permit ip any any inactive
access-list DMZ_access_in extended permit ip object DMZ object obj_any inactive
access-list outside_1_cryptomap extended permit ip object obj-192.168.73.0 object Sixpines
access-list dmz extended permit ip object obj_any object DMZ
!
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
nat (inside,any) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (inside,outside) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (dmz,outside) source static DMZ DMZ
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 69.15.200.137 1


Comment
Watch Question
This problem has been solved!
Unlock 1 Answer and 10 Comments.
See Answer
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE