Re: ASA 5505 - Allow DMZ to Access Internal network

["Fetch, Brandon" <bfetch () tpg com>]

MK,

I'll initially set aside why you'd want to allow any of your DMZ
networks unlimited access to your inside network as that sort of defeats
the purpose of a firewall.

We can take that up at the end.

 

The source of your problem is determining what the source IP address is
of a request leaving a DMZ network to enter the inside network.

NAT is what performs this function and it would appear to be some
extraneous NAT commands related to your DMZ networks.

 

If you wish to maintain your networks source/destination addresses
within the portions of the network you control (DMZ's & inside) then I'd
suggest performing a nat 0 for all of your 'internal' networks.

This will ensure no translation is done on requests that enter/leave
corporate networks.

 

Expand your nonat list to include all of your DMZ segments - be sure to
include the inverse (Inside --> DMZ and DMZ --> Inside) of each ACE so
you're not stuck troubleshooting why something is being blocked.

 

Once you've reconfigured whether the firewall will NAT (or not NAT in
this case) the segments you can then focus on the appropriate ACL to
allow your DMZ networks access to the Inside.

 

To that, I'd highly (and I mean seriously reconsider) allowing all DMZ
hosts unlimited/unrestricted access to your inside network.  The purpose
of security levels and segmenting of services/resources is to only have
to focus on by default, keeping secure the key components of your
environment.  By default the ASA will not allow any connections to pass
from a lower-security (numerical) interface to a higher (numerical)
interface without an explicit ACL.  With what you want to do you've
eliminated a key function of the firewall which will cause you no end of
grief if something is compromised.

 

I'd suggest reconfiguring the NAT portions of things:

nat (inside) 0 access-list nonat, nat (DMZ1) 0 access-list nonat...and
then you can focus on only allowing what you want to enter the inside
network from any of the DMZ's.

After you've identified only the necessary services/ports that DMZ hosts
need to reach on the Inside you can breathe easy there's nothing else
you have to do to prevent DMZ hosts from compromising an inside host.

 

An example of a DMZ ACL:

 

access-list DMZ-to-inside permit tcp host dmz_address1 host
inside_address1 eq 80

access-list DMZ-to-inside permit udp host dmz_address2 host
inside_address2 eq 53

access-list DMZ-to-inside deny ip dmz_network dmz_subnet inside_network
inside_subnet

access-list DMZ-to-inside permit ip any any

 

Remember, once you apply an ACL there's an implicit "deny ip any any"
but in this case it will prevent the DMZ hosts from even reaching the
Internet.

But before you can do the "permit ip any any" you must ensure your
internal network is not compromised by it which is why line 3 is
present.

 

Hope that helps and you re-evaluate your desire to allow all DMZ hosts
to the inside networks.

Brandon

 

________________________________

From: firewall-wizards-bounces () listserv icsalabs com
[mailto:firewall-wizards-bounces () listserv icsalabs com] On Behalf Of
Manoj Kalpage
Sent: Monday, October 06, 2008 10:28 AM
To: Firewall Wizards Security Mailing List
Subject: [fw-wiz] ASA 5505 - Allow DMZ to Access Internal network

 

Hi All,
I am trying configure giving DMZ to access everything in internal
network. I have configuration bellow for DMZ to internal but I cannot
ping to either of network. Is this allow with ASA ver 8.0? Am I doing
something wrong?
Any help would be greatly appreciated.

Thanks in advance.

MK

interface Vlan1
 description For XXXX Network
 nameif inside
 security-level 100
 ip address 172.24.53.2 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 pppoe client vpdn group Bitddd
 ip address pppoe setroute
!
interface Vlan3
 description for Back Office Network
 nameif DMZ1
 security-level 100
 ip address 172.23.53.1 255.255.255.0
!
interface Vlan4
 description DMZ2 for XXX Network
 nameif DMZ2
 security-level 75
 ip address 192.168.30.1 255.255.255.0

interface Ethernet0/0
 description To Outside
 switchport access vlan 2
!
interface Ethernet0/1
 description To XXX Network
!
interface Ethernet0/2
 description To Inside Back Office Network
 switchport access vlan 3
!
interface Ethernet0/3
 description To XXX Network
 switchport access vlan 4

access-list acl_DMZ2_to_INSIDE extended permit tcp any any
access-list acl_DMZ2_to_INSIDE extended permit udp any any

global (outside) 1 interface
global (DMZ1) 1 interface
global (DMZ2) 1 interface
global (DMZ3) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 172.24.53.0 255.255.255.0
nat (DMZ1) 1 172.23.53.0 255.255.255.0
nat (DMZ2) 1 192.168.30.0 255.255.255.0
nat (DMZ3) 1 192.168.100.0 255.255.255.0
static (inside,DMZ2) 192.168.30.0 172.24.53.0 netmask 255.255.255.255

access-group acl_DMZ2_to_INSIDE in interface DMZ2

icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply inside
icmp permit any echo inside
icmp permit any echo-reply outside
icmp permit any echo outside
icmp permit any echo-reply DMZ1
icmp permit any echo DMZ1
icmp permit any echo-reply DMZ2
icmp permit any echo DMZ2
icmp permit any echo-reply DMZ3
icmp permit any echo DMZ3




This message is intended only for the person(s) to which it is addressed 
and may contain privileged, confidential and/or insider information. 
If you have received this communication in error, please notify us 
immediately by replying to the message and deleting it from your computer. 
Any disclosure, copying, distribution, or the taking of any action concerning
the contents of this message and any attachment(s) by anyone other 
than the named recipient(s) is strictly prohibited.

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards