Disclaimer
Before you ask why I don't just put everything on the 192.168.1.0/24 network, let me just say I do this on another person's will.
Info:
For purposes of this question I will refer to "Internal Network" as the 192.168.0.0/24 located on the inside interface of the internal ASA
Domain names and public Ip's changed for protection of the client.
Domain names changed to domain, public IP's represented by xxx.xxx.xxx.###
Objective:
To Setup Edge/Web Services that can communicate through 2 ASA 5510's to the Internal network. Allowing me to use the Edge server on the perimeter
To be able to hit the internet from all network points.
To be able to ping internally from any location to any location but not outside_in
To be able to maintain remote access to the internal servers
To not be laughed at for not putting the servers on the inside of the external ASA (hehe)
From the DMZ to the "Internal Network" (the main challenge, not working)
DNS
ICMP
tcp/50389
upd/50636
SMTP (to the internal exchange server)
From the Internal Network to the DMZ (everything currently is working, but as other changes might cause this to close I will need the following)
ICMP
tcp/50389
udp/50636
HTTP
HTTPS
SMTP (from the internal exchange server)
All networks should have outbound access "outside" to the world
From the Outside in to the "internal network"
3389 (Working but if you have me change something elsewhere to break it, please fix it :))
From the outside to the DMZ
SMTP
http
https
(perhaps more later but for now this is it)
Current Status:
Currently I can ping into the DMZ from the Internal Network
From the DMZ I can ping to 192.168.1.2
I can see http from the internal network on the DMZ
All networks currently can browse the internet.
RDP all the way in to the Internal network, works.
I would like to point out that I will make it a point to post working configs once this is finished.
I also appreciate any help offered.
The External ASA
Code:
ASA Version 8.0(2) ! hostname external domain-name domain.local enable password sg5gh5uh45g6 encrypted names dns-guard ! interface Ethernet0/0 nameif outside security-level 0 ip address xxx.xxx.xxx.82 255.255.255.248 ! interface Ethernet0/1 nameif inside security-level 49 ip address 192.168.1.1 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 nameif dmz security-level 40 ip address 10.10.10.1 255.255.255.0 ! interface Management0/0 shutdown no nameif no security-level no ip address management-only ! passwd iG0FMG.8O3nPFSqf encrypted boot system disk0:/asa802-k8.bin boot config disk0:/flash ftp mode passive clock timezone CST -5 dns domain-lookup outside dns domain-lookup inside dns domain-lookup dmz dns server-group Internal name-server 192.168.0.11 name-server 192.168.0.13 domain-name domain.local dns-group Internal same-security-traffic permit inter-interface object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service rdp tcp port-object eq 3389 object-group service DM_INLINE_TCP_1 tcp port-object eq 50000 port-object eq 50001 object-group service DM_INLINE_TCP_2 tcp port-object eq 50000 port-object eq 50001 access-list dmz-in extended permit tcp any host 10.10.10.10 eq smtp access-list dmz-in extended permit tcp any host 10.10.10.10 eq www access-list dmz-in extended permit tcp any host 10.10.10.10 eq https access-list dmz-in extended permit icmp any any access-list dmz-in extended permit ip 10.10.10.0 255.255.255.0 any access-list dmz_access_in extended permit ip 10.10.10.0 255.255.255.0 any access-list outside_access_in extended permit tcp any any eq 3389 access-list inside_access_in extended permit icmp any any access-list inside_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any dmz asdm image disk0:/asdm-602.bin no asdm history enable arp timeout 14400 global (outside) 1 interface global (inside) 2 interface global (dmz) 3 interface nat (inside) 1 0.0.0.0 0.0.0.0 nat (dmz) 1 0.0.0.0 0.0.0.0 static (dmz,outside) tcp interface smtp 10.10.10.10 smtp netmask 255.255.255.255 static (inside,outside) tcp interface 3389 192.168.1.2 3389 netmask 255.255.255.255 static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group dmz-in in interface dmz route outside 0.0.0.0 0.0.0.0 74.117.105.81 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy aaa authorization command LOCAL aaa authorization exec authentication-server http server enable http 192.168.0.0 255.255.255.0 inside http 10.10.10.0 255.255.255.0 dmz http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart no crypto isakmp nat-traversal telnet xxx.xxx.xxx.0 255.255.255.0 outside telnet 0.0.0.0 0.0.0.0 inside telnet timeout 5 ssh 0.0.0.0 0.0.0.0 outside ssh 192.168.1.0 255.255.255.0 inside ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect http ! service-policy global_policy global ntp server 192.43.244.18 source outside prefer username admin password sfdgfgs45g5gh45h== nt-encrypted privilege 15 prompt hostname context
The Internal ASA
Code:
ASA Version 8.0(2) ! hostname internal domain-name domain.local enable password f443fg5sg45g encrypted names name 10.10.10.10 nlf-srv-004 description Front End Server name 192.168.0.11 nlf-srv-001 description DC1 name 192.168.0.12 nlf-srv-002 description Exchange dns-guard ! interface Ethernet0/0 nameif outside security-level 50 ip address 192.168.1.2 255.255.255.0 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! passwd sg45g5g45g45 encrypted boot system disk0:/asa802-k8.bin ftp mode passive clock timezone CST -6 clock summer-time CDT recurring dns domain-lookup outside dns domain-lookup inside dns server-group DefaultDNS domain-name domain.local dns server-group Internal name-server nlf-srv-001 name-server 192.168.0.13 domain-name domain.local dns-group Internal same-security-traffic permit inter-interface object-group protocol TCPUDP protocol-object udp protocol-object tcp access-list out-in extended permit icmp any any access-list out-in extended permit tcp any any eq smtp access-list out-in extended permit tcp any any eq 3389 access-list out-in extended permit ip any any access-list inside extended permit tcp any host nlf-srv-002 eq smtp access-list inside extended permit ip xxx.xxx.xxx.80 255.255.255.248 192.168.0.0 255.255.255.0 access-list inside extended permit ip any any access-list inside extended permit icmp any any pager lines 24 logging enable logging console debugging logging asdm informational mtu outside 1500 mtu inside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any outside icmp permit any inside asdm image disk0:/asdm-602.bin no asdm history enable arp timeout 14400 global (outside) 1 interface global (inside) 2 interface nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) tcp interface 3389 nlf-srv-001 3389 netmask 255.255.255.255 access-group out-in in interface outside access-group inside in interface inside route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart no crypto isakmp nat-traversal telnet 0.0.0.0 0.0.0.0 outside telnet 192.168.0.0 255.255.255.0 inside telnet timeout 5 ssh 0.0.0.0 0.0.0.0 outside ssh 192.168.0.0 255.255.255.0 inside ssh timeout 5 console timeout 0 management-access inside dhcpd address 192.168.0.50-192.168.0.150 inside dhcpd dns nlf-srv-001 192.168.0.13 interface inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect http policy-map gloabl_policy class inspection_default ! service-policy global_policy global ntp server 192.43.244.18 source outside prefer prompt hostname context
Comment