Re: [fw-wiz] DMZ to INSIDE Communication

You need to apply an access list on your DMZ that allows it to talk to
servers on the inside...in this case specifically an SMTP server. That
means another access-group line as well as an accompanying access-list.

chris mr wrote:
Hello,

I have an ASA5505 and I'm stumped.

I have a IIS SMTP server on the DMZ and it is able to communicate with OUTSIDE smtp servers on port 25. I want it to be able to communicate with INSIDE smtp servers, however the packets get dropped.
WEBSERVER:gt1023---------->DMZ>>>INSIDE---xx--->EXCHANGE:25

Here is the setup:

Interfaces/Vlans:
-Outside
security=0
IP 75.xx.yy.233
-Outside1
security=0 ( backup ISP )
IP 12.xx.yy.154
-Inside
security=100
IP 200.xx.yy.158
-DMZ
security=50
IP 192.168.2.1



Here is my relevant setup:
name 192.168.2.2 WEBSERVER_nat >> on DMZ interface
name 192.168.2.3 WEBSERVER_nat1 >> on DMZ interfce
name 75.xx.yy.234 WEBSERVER_real >> public IP of web server
name 12.xx.yy.155 WEBSERVER_real1 >> public IP of web server (round-robin DNS setup)
name 200.xx.yy.10 GATEWAY >> MS ISA server on Inside interface
name 200.xx.yy.11 EXCHANGE >> MS Exchange on Inside interface

global (outside1) 2 interface
global (DMZ) 2 interface
global (outside) 2 interface

nat (inside) 2 GATEWAY 255.255.255.255
nat (inside) 2 EXCHANGE 255.255.255.255

static (inside,outside) tcp interface smtp EXCHANGE smtp netmask 255.255.255.255
static (inside,outside1) tcp interface smtp EXCHANGE smtp netmask 255.255.255.255
static (DMZ,outside1) WEBSERVER_real1 WEBSERVER_nat netmask 255.255.255.255 tcp 0 25
static (DMZ,inside) WEBSERVER_real1 WEBSERVER_nat1 netmask 255.255.255.255
static (DMZ,outside) WEBSERVER_real WEBSERVER_nat netmask 255.255.255.255 tcp 0 25
static (DMZ,inside) WEBSERVER_real WEBSERVER_nat netmask 255.255.255.255

access-group ACLIN in interface outside1
access-group ACLIN in interface outside

access-list ACLIN extended deny ip 172.16.0.0 255.255.0.0 interface outside log
access-list ACLIN extended deny ip 192.168.0.0 255.255.0.0 interface outside log
access-list ACLIN extended deny ip 10.0.0.0 255.0.0.0 interface outside log
access-list ACLIN extended deny ip 10.0.0.0 255.0.0.0 interface outside1 log
access-list ACLIN extended deny ip 192.168.0.0 255.255.0.0 interface outside1 log
access-list ACLIN extended deny ip 172.16.0.0 255.255.0.0 interface outside1 log
access-list ACLIN extended permit tcp any host 75.xx.yy.233 object-group INSIDE_services (smtp)
access-list ACLIN extended permit tcp any host 12.xx.yy.154 object-group INSIDE_services (smtp)
access-list ACLIN extended permit icmp any object-group DMZ (WEBSERVER_real and _real1) object-group DMZ_icmp log
access-list ACLIN extended permit icmp any interface outside object-group OUTSIDE_icmp (echo/reply)
access-list ACLIN extended permit icmp any interface outside1 object-group OUTSIDE_icmp
access-list ACLIN extended permit tcp any object-group DMZ object-group DMZ_services (http/https/ftp)
access-list ACLIN extended permit tcp any eq domain object-group DMZ log
access-list ACLIN extended permit udp any eq domain object-group DMZ log
access-list ACLIN extended deny ip any any log



____________________________________________________________________________________
Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out.
http://answers.yahoo.com/dir/?link=list&sid=396545469
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • [fw-wiz] Double firewall setup (long)
    ... One PIX 515E w/ 3 interfaces: inside, outside, DMZ. ... access-list OUTB permit tcp 10.181.8.0 255.255.248.0 any eq www ... interface ethernet0 auto ...
    (Firewall-Wizards)
  • Re: Exchange 2003 Routingproblem
    ... Also erstmal mein Beileid zu deiner Idee den selben Server mit einem ... Da kannst du dir die DMZ ja gleich schenken und einfache Portforwardings ... Jedes Interface braucht das jeweilige Gateway im Segment und das Routing ... Next by Date: ...
    (microsoft.public.de.exchange)
  • Re: [fw-wiz] PIX access-list help
    ... Easiest thing to remember is any communication is allowed from a higher ... DMZ, DMZ to outside) unless explicitly prevented. ... You create an ACL and apply it either in or out of the interface. ... are applied "access-group out interface blah". ...
    (Firewall-Wizards)
  • Re: Configuring Cisco PIX 520.
    ... interface so that each of the 4 interfaces will be its own network ... DMZ network: 192.168.3.0/24 ... fixup protocol dns maximum-length ...
    (comp.dcom.sys.cisco)
  • Re: Configuring Cisco PIX 520.
    ... interface so that each of the 4 interfaces will be its own network ... DMZ network: 192.168.3.0/24 ... fixup protocol dns maximum-length ...
    (comp.dcom.sys.cisco)