Hi!
I have an interesting problem about configuring
external access with Cisco ASA5505 NAT for a local mail server in dmz.
If I configure Cisco NAT with another public IP
for a test mail server in dmz, it works.
(internet, DNS resolution, LAN->DMZ traffic all OK)
After the shutdown of the real mail server,
and reconfiguration of NAT with the mail server’s own public IP, and the IP in the access lists below it doesn’t work.
(on the same port and with same tcp/ip config like the test mail server)
I can ping the dmz interface IP, but cannot ping outside IP’s, either the DNS servers of the ISP. So the mail server cannot reach internet sites and it is inaccessible from outside. (I tried to disable windows firewall,
replace network card, reset tcp/ip and of course restart router and mail server too.)
Config of the test/local dmz mail server:
IP: 192.168.2.2
MASK: 255.255.255.0
Gateway: 192.168.2.1
DNS: External ISP DNS
Here is my router config:
interface Vlan1
nameif LAN
security-level 100
ip address 192.168.1.1 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif WAN
security-level 0
ip address x.x.x.x 255.255.255.248
ospf cost 10
!
interface Vlan12
no forward interface Vlan1
nameif DMZ
security-level 0
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 12
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
switchport access vlan 32
!
interface Ethernet0/7
switchport access vlan 22
!
dns domain-lookup WAN
dns server-group DefaultDNS
name-server x.x.x.x (external ISP DNS)
name-server x.x.x.x (external ISP DNS)
domain-name xyz.xyz
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service
port-object eq daytime
port-object eq chargen
port-object eq telnet
port-object eq echo
port-object eq finger
port-object eq discard
object-group service MailServer tcp
port-object eq 465
port-object eq 995
port-object eq ftp
port-object eq ftp-data
port-object eq https
port-object eq imap4
port-object eq ldap
port-object eq pop3
port-object eq smtp
access-list WAN_access_in extended permit icmp any any echo-reply log
access-list WAN_access_in extended permit icmp any any 2 log
access-list WAN_access_in extended permit icmp any any unreachable log
access-list WAN_access_in extended permit icmp any any source-quench log
access-list WAN_access_in extended permit icmp any any time-exceeded log
access-list WAN_access_in extended permit tcp any host “mail server public IP” object-group MailServer log
access-list WAN_access_in extended deny icmp any any log
access-list WAN_access_in extended deny udp any interface WAN eq snmp log
access-list WAN_access_in extended deny tcp any interface WAN object-group
access-list WAN_access_in extended deny ip 127.0.0.0 255.0.0.0 interface WAN log
access-list WAN_access_in extended deny ip 192.168.0.0 255.255.0.0 interface WAN log
access-list WAN_access_in extended deny ip 172.16.0.0 255.240.0.0 interface WAN log
access-list WAN_access_in extended deny ip 10.0.0.0 255.0.0.0 interface WAN log
access-list WAN_access_in extended deny ip 224.0.0.0 240.0.0.0 interface WAN log
access-list WAN_access_in extended deny ip 240.0.0.0 248.0.0.0 interface WAN log
access-list LAN_access_in extended permit ip any any log
access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list DMZ_access_in extended permit ip any any log
access-list DMZ_access_in_1 extended permit ip any any log
access-list DMZ_access_in_1 extended permit tcp host “mail server public IP” any object-group MailServer log
mtu LAN 1500
mtu WAN 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo WAN
arp timeout 14400
nat (LAN) 1 0.0.0.0 0.0.0.0
static (DMZ,WAN) “mail server public IP” 192.168.2.2 netmask 255.255.255.255
static (LAN,DMZ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
access-group LAN_access_in in interface LAN
access-group WAN_access_in in interface WAN
access-group DMZ_access_in_1 in interface DMZ
route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dhcpd auto_config WAN
!
dhcpd address 192.168.1.2-192.168.1.33 LAN
dhcpd dns “ISPDNS IP” interface LAN
dhcpd lease 691200 interface LAN
dhcpd enable LAN
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
smtp-server “mail server public IP”
If there is a workaround or whatever an idea about this problem, please notify me. Thanks.
Lengyel P?ter
plengyel@freemail.hu