No/connection between dmz & internal. conf included

Hi guys!
I have a DMZ with webservers who need to connect to a SQL server (port 1433) on the internal network.

I tried with static routes and didnt connect.. What i'm doing wrong?

I receive a message:
" portmap translation creation failed for tcp 1433" from webserver (dmz) to sql server on the internal network.

I'm a rookie with little knowledge with ASA firewalls. So if theres is a standard configuration or a template to connect:

Outside ----> DMZ (webservers)

---

> SQl Servers (Data)(Internal Network

This is the configuration:

Result of the command: "show running-config"

: Saved
:
ASA Version 8.0(3)
!
hostname
domain-name ##
enable password ##### encrypted
names
name 192.168.1.11 PRH05WEB
name 76.76.194.163 Public_APP_Server
name 76.76.194.162 Public_WWW
name 192.168.1.14 PRH02APP
name 131.15.2.55 SQL-CLUS-IP
name 131.15.2.53 SQL-Node1
name 131.15.2.41 SQL-Node2
name 131.15.2.42 Prh03sql
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address ####### 255.255.255.248
!
interface GigabitEthernet0/1
nameif inside
security-level 90
ip address 131.15.2.254 255.255.0.0
!
interface GigabitEthernet0/2
nameif dmz
security-level 10
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 10.0.0.1 255.255.255.0
!
passwd ###encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name AFVPR.local
object-group service WWW_SERVICES
description HTTP and HTTPS
service-object tcp eq www
service-object tcp eq https
object-group service mssql tcp
description Microsoft SQL
port-object eq 1433
object-group network DM_INLINE_NETWORK_1
network-object host PRH05WEB
network-object host PRH02APP
object-group network DM_INLINE_NETWORK_2
network-object host PRH05WEB
network-object host PRH02APP
object-group network DM_INLINE_NETWORK_3
network-object host PRH05WEB
network-object host PRH02APP
object-group network DM_INLINE_NETWORK_4
network-object host PRH05WEB
network-object host PRH02APP
object-group service DM_INLINE_TCP_3 tcp
port-object eq 1433
port-object eq 1434
object-group network SQL-Cluster-servers
network-object host SQL-Node2
network-object host Prh03sql
network-object host SQL-Node1
network-object host SQL-CLUS-IP
access-list outside_access_in extended permit object-group WWW_SERVICES any host Public_WWW
access-list outside_access_in extended permit object-group WWW_SERVICES any host Public_APP_Server
access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 range 1 65535 host SQL-CLUS-IP eq 445
access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_2 range 1 65535 host SQL-CLUS-IP object-group DM_INLINE_TCP_3
access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_3 range 1 65535 host SQL-CLUS-IP eq netbios-ssn
access-list dmz_access_in extended permit icmp object-group DM_INLINE_NETWORK_4 host SQL-CLUS-IP
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-611.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 101 interface
global (outside) 2 Public_APP_Server netmask 255.0.0.0
global (outside) 1 Public_WWW netmask 255.0.0.0
global (dmz) 200 192.168.1.2-192.168.1.254 netmask 255.255.255.0
nat (inside) 101 131.15.0.0 255.255.0.0
nat (dmz) 1 PRH05WEB 255.255.255.255
nat (dmz) 2 PRH02APP 255.255.255.255
nat (management) 101 10.0.0.0 255.255.255.0
static (dmz,outside) tcp Public_WWW www PRH05WEB www netmask 255.255.255.255
static (dmz,outside) tcp Public_APP_Server www PRH02APP www netmask 255.255.255.255
static (dmz,outside) tcp Public_WWW https PRH05WEB https netmask 255.255.255.255
static (dmz,outside) tcp Public_APP_Server https PRH02APP https netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 #######1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.0.0.2 255.255.255.255 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics
username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:31624e23da8af2f6668400770becf59a
: end

you need a static & access list both to define the intersted traffic coming from WEB DMZ to INSIDE,

may be it will help you,

static (inside,webservices) DB_MappedIP DB netmask 255.255.255.255 0 0
access-list name permit tcp host Webserver_NATed host DBSRV eq 1433

always remember if u r coming from lower security level to higher security then u need a translation & then access[/u]

Can I use this:

static (inside,dmz) 131.15.2.55 131.15.2.55 netmask 255.255.255.255

Can you helpme with this?

Config For check:

hostname #####

domain-name #####

enable password ##### encrypted

names

name 192.168.1.11 PRH05WEB

name 76.76.194.163 Public_APP_Server

name 76.76.194.162 Public_WWW

name 192.168.1.14 PRH02APP

name 131.15.2.55 SQL-CLUS-IP

name 131.15.2.53 SQL-Node1

name 131.15.2.41 SQL-Node2

name 131.15.2.42 Prh03sql

name 192.168.1.22 WWW_Load_Balanced description Clustered or Managed IP for WWW

!

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 76.76.194.164 255.255.255.248

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 131.15.2.253 255.255.0.0

!

interface GigabitEthernet0/2

nameif dmz

security-level 50

ip address 192.168.1.1 255.255.255.0

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 10.0.0.1 255.255.255.0

!

passwd #######encrypted

ftp mode passive

dns server-group DefaultDNS

domain-name ####.local

object-group service WWW_SERVICES

description HTTP and HTTPS

service-object tcp eq www

service-object tcp eq https

object-group service mssql tcp

description Microsoft SQL Port

port-object eq 1433

object-group network SQL-Cluster-servers

network-object host SQL-Node2

network-object host Prh03sql

network-object host SQL-Node1

network-object host SQL-CLUS-IP

object-group network Public_Web_Servers

network-object host PRH05WEB

network-object host PRH02APP

network-object host WWW_Load_Balanced

access-list outside_access_in extended permit object-group WWW_SERVICES any host Public_WWW

access-list outside_access_in extended permit object-group WWW_SERVICES any host Public_APP_Server

access-list inside_access_in extended permit tcp object-group Public_Web_Servers object-group SQL-Cluster-servers object-group mssql

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu dmz 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-611.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 101 interface

global (outside) 2 Public_APP_Server netmask 255.0.0.0

global (outside) 1 Public_WWW netmask 255.0.0.0

nat (inside) 101 131.15.0.0 255.255.0.0

nat (dmz) 1 PRH05WEB 255.255.255.255

nat (dmz) 2 PRH02APP 255.255.255.255

nat (management) 101 10.0.0.0 255.255.255.0

static (dmz,outside) tcp Public_WWW www PRH05WEB www netmask 255.255.255.255

static (dmz,outside) tcp Public_APP_Server www PRH02APP www netmask 255.255.255.255

static (dmz,outside) tcp Public_WWW https PRH05WEB https netmask 255.255.255.255

static (dmz,outside) tcp Public_APP_Server https PRH02APP https netmask 255.255.255.255

static (inside,dmz) 131.15.2.55 131.15.2.55 netmask 255.255.255.255

---

>Correct???*****************

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.0 #########1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 10.0.0.2 255.255.255.255 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics

username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:5a2ba21a2fad22600e1cd96da20d3109

: end