ASA 5510 - HTTP mv. forwardes ikke til server på inside interface
Hej.Jeg har ASA 5510, ASA v9.1(5), TDC modem(..1.1)<=>(..1.251)ASA(..10.1)<=>(10.251)Server
Jeg kan #'%%¤# ikke få http, ssh, mv. trafik til at flyde i gennem fw - Jeg har efterhånden prøvet alt og er ved at blive sindsyg.
På en 5505(direkte på public IP) har jeg næsten samme setup og det virker.
Når jeg sammenligner NAT og ACL kan jeg ikke se noget forkert.
Kan nogen ud fra denne Running Conf give mig en forklaring på hvorfor trafikken blokeres med denne log "TCP access denied by ACL from x.x.x.x/52206 to outside:192.168.1.251/80"
Alle bud værdsættes ;-)
Mvh
Teddy
: Saved
:
ASA Version 9.1(5)
!
hostname asa
domain-name r.local
enable password XX encrypted
names
ip local pool VPN_address_Poll 192.168.10.201-192.168.10.211 mask 255.255.0.0
!
interface Ethernet0/0
description Firewall outside interface
nameif outside
security-level 0
ip address 192.168.1.251 255.255.255.0
!
interface Ethernet0/1
description Firewall inside interface
nameif inside
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
shutdown
no nameif
security-level 100
ip address 10.0.0.1 255.255.255.0
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name r.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network TDC_Gateway
host 192.168.1.1
description TDC modem ip
object network inside_ip
host 192.168.10.1
description Firewall Inside interface IP
object network outside_ip
host 192.168.1.251
description Firewall Outside interface ip
object network Server_HTTP
host 192.168.10.251
description NAT af HTTP til Server
object network VPN_Pool
subnet 192.168.10.192 255.255.255.224
object network Server_Webmin
host 192.168.10.251
description NAT af Webmin til Server
object service Webmin
service tcp source range 1 65535 destination eq 10000
description Webmin på server
object network Server_Syslog
host 192.168.10.251
description Syslog server
object network Server
host 192.168.10.251
object network Server_SSH
host 192.168.10.251
object-group-search access-control
access-list outside_access_in extended permit tcp any any eq www
access-list outside_access_in extended permit object Webmin any any
access-list outside_access_in extended permit udp any eq syslog any eq syslog
access-list outside_access_in extended permit tcp any any eq ssh
pager lines 24
logging enable
logging asdm warnings
logging host inside 192.168.10.251
logging permit-hostdown
logging class auth asdm debugging
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static any any destination static VPN_Pool VPN_Pool no-proxy-arp route-lookup inactive
nat (outside,outside) source static VPN_Pool interface no-proxy-arp inactive description VPN turnaround for internet trafik
!
object network Server_HTTP
nat (any,outside) static interface service tcp www www
object network Server_Webmin
nat (any,outside) static interface service tcp 10000 10000
object network Server_Syslog
nat (any,outside) static interface service udp syslog syslog
object network Server_SSH
nat (any,outside) static interface service tcp ssh ssh
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 0.0.0.0 0.0.0.0 outside
http 192.168.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
sysopt connection timewait
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_r_dk
enrollment self
email r
subject-name CN=
ip-address 192.168.1.251
proxy-ldc-issuer
crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_r_dk
certificate a141db55
30820421 30820309 a0030201 020204a1 41db5530 0d06092a 864886f7 0d010105
05003081 9f311f30 1d06092a 864886f7 0d010901 16107468 7240726f 736b7669
73742e6e 6574310b 30090603 55040613 02444b31 11300f06 0355040a 1308526f
736b7669 73743114 30120603 55040313 0b726f73 6b766973 742e646b 3146301a
06092a86 4886f70d 01090813 0d313932 2e313638 2e312e32 35313028 06092a86
4886f70d 01090216 1b726f73 6b766973 742d6173 612e726f 736b7669 73742e6c
6f63616c 301e170d 31353038 32343138 35393136 5a170d32 35303832 31313835
3931365a 30819f31 1f301d06 092a8648 86f70d01 09011610 74687240 726f736b
76697374 2e6e6574 310b3009 06035504 06130244 4b311130 0f060355 040a1308
526f736b 76697374 31143012 06035504 03130b72 6f736b76 6973742e 646b3146
301a0609 2a864886 f70d0109 08130d31 39322e31 36382e31 2e323531 30280609
2a864886 f70d0109 02161b72 6f736b76 6973742d 6173612e 726f736b 76697374
2e6c6f63 616c3082 0122300d 06092a86 4886f70d 01010105 00038201 0f003082
010a0282 010100e8 19944b0c d5f9c5ac d6c016a4 504d73f6 b3992763 421f209e
df184fd5 193e1b46 156b16e8 6e1700cc 98ae8f43 f04dc559 af6d6cf8 39547995
76acf550 eb2d3320 195df991 038011d4 b0ee565c 350086db 14aa49b2 5cdab4d0
dadc17e4 79c06d52 fddc1bf8 15e668e6 debab8eb 8bf800a8 1ee19a50 9dae9fb8
7b4cff69 5ffc37ba 0a91d0d3 4de88d08 5da46a43 86294750 44794dde 88002af6
050df84c 9c4d96c9 f2fcf9f8 15ec598b 7cf35f1b 613e5043 c054a4a9 58460bab
3b4881fc 7ed0c3c8 caefefd8 59676724 13eab2e0 41ed0684 6ae6a8ab f97f7b5b
b5050356 46536a16 619f2f20 a20e68ae 49bdd573 67b82966 30c8d4ef 17276725
42f8575a a238c102 03010001 a3633061 300f0603 551d1301 01ff0405 30030101
ff300e06 03551d0f 0101ff04 04030201 86301f06 03551d23 04183016 801457fa
cffd49c7 0d384bdf 39d3c586 9f6b51da 4728301d 0603551d 0e041604 1457facf
fd49c70d 384bdf39 d3c5869f 6b51da47 28300d06 092a8648 86f70d01 01050500
03820101 00a0f6e0 8070fb91 b9dfd5b1 cb8b6138 9ac24ba1 ee625294 52db8eac
9c301e84 4fbd9ed9 90cd7bb0 fa77ff76 45affaf4 19522e3b 826d9aa9 9ba703ae
5e75397e c7456410 118f9912 a3ac05bb b8913839 edcac88d 04939c95 d620c09a
ba066b96 05fd62a8 5f384c2d 701fdf8f c290f1b2 7e4e1642 67f26865 e239df96
c96af31a 902ac29f a76fbc1f f089a1c1 aef507fc e9755817 772f634f dee2b8f0
b76ffee1 f445501a c85ffd70 6d06ba3d a2473d11 fef94504 51c92440 50ab21b4
2d4bef09 094a8236 1792c1ee 47947d56 fe71f540 6a2c5d08 4d22e38a 33d5d007
1607af27 0afc75ea 05be83f8 7c532b11 5063c429 dd90d4fa a4fe564c d8908ede
e266bdd6 a6
quit
crypto ikev2 remote-access trustpoint ASDM_r_dk
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.10.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn username thr password ***** store-local
dhcpd dns 8.8.8.8
dhcpd domain r.local
!
dhcpd address 192.168.10.10-192.168.10.240 inside
dhcpd domain r.local interface inside
dhcpd enable inside
!
threat-detection statistics host number-of-rate 3
threat-detection statistics port number-of-rate 3
threat-detection statistics protocol number-of-rate 3
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter updater-client enable
dynamic-filter use-database
dynamic-filter enable
dynamic-filter drop blacklist threat-level eq very-high
dynamic-filter blacklist
name mackeeper.com
ntp server 193.105.190.190 source outside prefer
ssl trust-point ASDM_r_dk outside
webvpn
enable outside
no anyconnect-essentials
anyconnect image disk0:/anyconnect/anyconnect-linux-3.1.04072-k9.pkg 1
anyconnect image disk0:/anyconnect/anyconnect-linux-64-3.1.04072-k9.pkg 2
anyconnect image disk0:/anyconnect/anyconnect-macosx-i386-3.1.04072-k9.pkg 3
anyconnect image disk0:/anyconnect/anyconnect-win-3.1.04072-k9.pkg 4
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_Homeland_anyconnect internal
group-policy GroupPolicy_Homeland_anyconnect attributes
wins-server none
dns-server value 8.8.8.8
vpn-tunnel-protocol ssl-client ssl-clientless
default-domain value vpn.r.local
webvpn
url-list value THR_Bookmarks
username X password X
username X attributes
webvpn
customization value Homeland_VPN_SSL
tunnel-group Homeland_anyconnect type remote-access
tunnel-group Homeland_anyconnect general-attributes
address-pool VPN_address_Poll
default-group-policy GroupPolicy_Homeland_anyconnect
tunnel-group Homeland_anyconnect webvpn-attributes
customization Homeland_VPN_SSL
group-alias Homeland_anyconnect enable
group-alias thr disable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
class class-default
user-statistics accounting
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
hpm topN enable
Cryptochecksum:X
: end
asdm history enable
