Hi!
I have an interesting problem about configuring
external access with Cisco ASA5510 for a local mail server in dmz.
It’s not working to access the
outside ISP DNS servers with configured
static from the mail server in DMZ.
With nslookup I have the following logs,
and request timeout:
access-list DMZ_access_in permitted udp DMZ/192.168.2.2(4922) -> WAN/62.77.203.10(53) hit-cnt 1 first hit [0xc651a8ad, 0x0]
Built outbound UDP connection 16571 for WAN:62.77.203.10/53 (62.77.203.10/53) to DMZ:192.168.2.2/4922 (MAIL/4922)
Teardown UDP connection 15991 for WAN:62.77.203.10/53 to DMZ:192.168.2.2/4905 duration 0:02:01 bytes 41
Teardown UDP connection 16021 for WAN:62.77.203.10/53 to DMZ:192.168.2.2/4906 duration 0:02:02 bytes 30
If I use our inside DNS server, I have the
following logs, with SYN timeout, but
I get the outside IP from the server:
(with static DMZ to LAN, LAN to DMZ & DMZ/LAN Incoming tcp/udp permit any)
access-list DMZ_access_in permitted udp DMZ/192.168.2.2(1029) -> LAN/192.168.0.10(53) hit-cnt 1 first hit [0x498320c, 0x0]
Built inbound UDP connection 22023 for DMZ:192.168.2.2/1029 (192.168.2.2/1029) to LAN:192.168.0.10/53 (192.168.0.10/53)
Teardown UDP connection 22023 for DMZ:192.168.2.2/1029 to LAN:192.168.0.10/53 duration 0:00:00 bytes 76
Teardown TCP connection 21983 for WAN:66.249.91.103/80 to DMZ:192.168.2.2/5000 duration 0:00:30 bytes 0 SYN Timeout
interface Ethernet0/0
nameif WAN
security-level 0
ip address x.x.x.178 255.255.255.248
!
interface Ethernet0/1
nameif LAN
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/2
nameif DMZ
security-level 50
ip address 192.168.2.1 255.255.255.0
dns domain-lookup WAN
dns server-group DefaultDNS
name-server x.x.x.x (ISP DNS)
name-server x.x.x.x (ISP DNS)
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service MailServerTCP tcp
description Mail Server
port-object eq pop3
port-object eq smtp
port-object eq https
port-object eq 465
port-object eq 995
port-object eq imap4
port-object eq ldap
port-object eq ftp-data
port-object eq ftp
port-object eq domain
object-group service MailServerUDP udp
description Mail Server
port-object eq domain
access-list WAN_access_in extended permit tcp any host x.x.x.182 255.255.255.255 object-group MailServerTCP log
access-list WAN_access_in extended permit udp any host x.x.x.182 255.255.255.255 object-group MailServerUDP log
access-list LAN_access_in extended permit ip any any log
access-list DMZ_access_in extended permit tcp any host x.x.x.182 255.255.255.255 object-group MailServerTCP log
access-list DMZ_access_in extended permit ip any any log
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo WAN
nat-control
global (WAN) 1 interface
nat (LAN) 1 0.0.0.0 0.0.0.0
static (DMZ,WAN) x.x.x.182 192.168.2.2 netmask 255.255.255.255 dns
access-group WAN_access_in in interface WAN
access-group LAN_access_in in interface LAN
access-group DMZ_access_in in interface DMZ
route WAN 0.0.0.0 0.0.0.0 x.x.x.177 1
Please help me, if there is a solution.
Thanks.
Lengyel P?ter
