Simple Cisco ASA 5505 config issue
- by Ben Sebborn
I have a Cisco ASA setup with two interfaces:
inside: 192.168.2.254 / 255.255.255.0 SecLevel:100
outside: 192.168.3.250 / 255.255.255.0 SecLevel: 0
I have a static route setup to allow PCs on the inside network to access the internet via a gateway on the outside interface (3.254):
outside 0.0.0.0 0.0.0.0 192.168.3.254
This all works fine.
I now need to be able to access a PC on the outside interface (3.253) from a PC on the inside interface on port 35300. I understand I should be able to do this with no problems, as I'm going from a higher security level to a lower one. However I can't get any connection.
Do I need to set up a seperate static route? Perhaps the route above is overriding what I need to be able to do (is it routing ALL traffic through the gateway?)
Any advice on how to do this would be apprecaited.
I am configuring this via ASDM but the config can be seen as below:
Result of the command: "show running-config"
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
domain-name xxx.internal
names
name 192.168.2.201 dev.xxx.internal description Internal Dev server
name 192.168.2.200 Newserver
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.3.250 255.255.255.0
!
!
time-range Workingtime
periodic weekdays 9:00 to 18:00
!
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
name-server Newserver
domain-name xxx.internal
same-security-traffic permit inter-interface
object-group service Mysql tcp
port-object eq 3306
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list inside_access_in extended permit ip any any
access-list outside_access_in remark ENABLES OUTSDIE ACCESS TO DEV SERVER!
access-list outside_access_in extended permit tcp any interface outside eq www time-range Workingtime inactive
access-list outside_access_in extended permit tcp host www-1.xxx.com interface outside eq ssh
access-list inside_access_in_1 extended permit tcp any any eq www
access-list inside_access_in_1 extended permit tcp any any eq https
access-list inside_access_in_1 remark Connect to SSH services
access-list inside_access_in_1 extended permit tcp any any eq ssh
access-list inside_access_in_1 remark Connect to mysql server
access-list inside_access_in_1 extended permit tcp any host mysql.xxx.com object-group Mysql
access-list inside_access_in_1 extended permit tcp any host mysql.xxx.com eq 3312
access-list inside_access_in_1 extended permit object-group TCPUDP host Newserver any eq domain
access-list inside_access_in_1 extended permit icmp any any
access-list inside_access_in_1 remark Draytek Admin
access-list inside_access_in_1 extended permit tcp any 192.168.3.0 255.255.255.0 eq 4433
access-list inside_access_in_1 remark Phone System
access-list inside_access_in_1 extended permit tcp any 192.168.3.0 255.255.255.0 eq 35300 log disable
pager lines 24
logging enable
logging asdm warnings
logging from-address [email protected]
logging recipient-address [email protected] level errors
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ipv6 access-list inside_access_ipv6_in permit tcp any any eq www
ipv6 access-list inside_access_ipv6_in permit tcp any any eq https
ipv6 access-list inside_access_ipv6_in permit tcp any any eq ssh
ipv6 access-list inside_access_ipv6_in permit icmp6 any any
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface www dev.xxx.internal www netmask 255.255.255.255
static (inside,outside) tcp interface ssh dev.xxx.internal ssh netmask 255.255.255.255
access-group inside_access_in in interface inside control-plane
access-group inside_access_in_1 in interface inside
access-group inside_access_ipv6_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.3.254 10
route outside 192.168.3.252 255.255.255.255 192.168.3.252 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
aaa authentication enable console LOCAL
