Avatar of zoojames
zoojames
Flag for United States of America asked on

Cisco ASA 5510 DMZ needs access to outside

I am trying to allow access to the internet from my dmz.  The postings I have read on this site specify setting up a NAT. Since my firewall is live and I do not want to loose my job, would the following NAT break anything given the current NAT setup on my ASA 5510....

CURRENT....
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 10.20.30.0 255.255.255.0
nat (ids) 1 172.16.0.0 255.255.0.0

WOULD LIKE TO ADD...

nat (dmz) 1 192.168.50.0 255.255.255.0

Will this break anything? Is this necessary to allow internet access from dmz? I have a VPN router in the dmz that needs to talk to another vpn router in another location.
Hardware FirewallsRoutersNetworking Hardware-Other

Avatar of undefined
Last Comment
zoojames

8/22/2022 - Mon
Brian Garcia

what do you want to accomplish? do you just need an internet access for the DMZ? Can you paste the whole configuration?

Adding NAT for DMZ could have an effect on the traffic flow for the DMZ network.
fgasimzade

Adding this command will not do any harm, but is it really what you need?
zoojames

ASKER
well this is what I have setup, just not sure if it will work. I assume some level of outbound access from the dmz to the cloud is needed for the csico 2900 vpn router (sitting in the dmz) to create an  ipsec tunnel another 2900 elsewhere in the internet......

static (dmz,outside) 64.X.X.240 192.168.50.2 netmask 255.255.255.255

I have no problem keeping outbound from dmz locked, but i don't see how anything can communicate out.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER CERTIFIED SOLUTION
fgasimzade

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
zoojames

ASKER
I got the result I was looking for with the confirmation from fgasimzade, however I should consider keeping the outbound dmz traffic locked down to minimum.