Skip to main content

DMZ access to internal network

More
15 years 3 weeks ago #32497 by beewood
Hi,

I need to have all hosts in the dmz to be able to access two devices on the internal network, 192.168.1.245 & 192.168.1.246 over tcp port 910 only. Does anyone know how I can do this? I think I need a static statement and an acl, but unsure.

hostname ASA5505

!
interface Vlan1
nameif LAN
security-level 100
ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 172.16.1.253 255.255.255.0
!
interface Vlan3
no forward interface Vlan1
nameif DMZ
security-level 50
ip address 10.254.254.254 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
no shutdown
!
interface Ethernet0/1
switchport access vlan 3
no shutdown
!
interface Ethernet0/2
switchport access vlan 1
no shutdown
!
interface Ethernet0/3
switchport access vlan 1
no shutdown
!
interface Ethernet0/4
switchport access vlan 1
no shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
switchport access vlan 1
no shutdown
!
interface Ethernet0/7
switchport access vlan 1
no shutdown
!
global (outside) 1 interface
nat (DMZ) 1 10.254.254.0 255.255.255.0
nat (LAN) 1 192.168.1.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 172.16.1.254 1
dhcpd address 192.168.1.1-192.168.1.10 LAN
dhcpd dns 61.9.194.49 61.9.195.193
domain-name test.local
dhcpd lease 172800
dhcpd enable LAN
ssh 0.0.0.0 0.0.0.0 LAN
ssh timeout 5
More
15 years 3 weeks ago #32502 by rtrice81
try this

-access-list inside_access_in extend permit tcp 10.254.254.0 255.255.255.0 eq 910 192.168.1.245 255.255.255.255 eq 910

-access-list inside_access_in extend permit tcp 10.254.254.0 255.255.255.0 eq 910 192.168.1.246 255.255.255.255 eq 910

you may access have to do a nat exempt as well

-access-list dmz_nat0_outbound extended permit ip 10.254.254.0 255.255.255.0 192.168.1.0 255.255.255.0

Rich Trice
KR Tech Solutions - networks of the future
More
15 years 3 weeks ago #32524 by beewood
thanks, I tried that out and it doesn't work. The reason is I have a restricted license, restricted license doesn't allow the dmz access to the inside vlan. So thats that.
Time to create page: 0.121 seconds