ASA 5505 (8.3.1) DMZ to Outside access problem

Question

We have a hub and spoke VPN setup and at one location used the DMZ port/vlan subnet to access the hub. We have since changed and want the DMZ to only access the outside interface (have base license that can only access one interface). We have taken out all the configs that allow access to inside/VPN but can not get the DMZ to access Outside/internet. I also do not see any debug info in the logs. We have read a ton but it seems that there are changes in 8.3 that are not documented well enough for us to get this going. Does anybody see what we are missing?
Full Config:
ASA Version 8.3(1)
hostname Rye5505
domain-name thedavid
enable password  encrypted
passwd  encrypted
names
name 192.168.72.0 Sixpines description VPN
interface Vlan1
nameif inside
security-level 100
ip address 192.168.73.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 69.15.200.138 255.255.255.252
interface Vlan5
no forward interface Vlan1
nameif dmz
security-level 50
ip address 192.168.1.1 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 5
boot system disk0:/asa831-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name thedavid
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network 192.168.72.0
subnet 192.168.72.0 255.255.255.0
description Sixpines  
object network NETWORK_OBJ_192.168.73.0_24
subnet 192.168.73.0 255.255.255.0
object network obj-192.168.73.0
subnet 192.168.73.0 255.255.255.0
object network Sixpines
subnet 192.168.72.0 255.255.255.0
object network DMZ
subnet 192.168.1.0 255.255.255.0
object-group network SixpinesInternalNetwork
network-object Sixpines 255.255.255.0
access-list DMZ_access_in extended permit ip any any inactive
access-list DMZ_access_in extended permit ip object DMZ object obj_any inactive
access-list outside_1_cryptomap extended permit ip object obj-192.168.73.0 object Sixpines
access-list dmz extended permit ip object obj_any object DMZ
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any dmz
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
nat (inside,any) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (inside,outside) source static obj-192.168.73.0 obj-192.168.73.0 destination static Sixpines Sixpines
nat (dmz,outside) source static DMZ DMZ
object network obj_any
nat (inside,outside) dynamic interface
access-group dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 69.15.200.137 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.73.0 255.255.255.0 inside
http 10.0.1.0 255.255.255.0 dmz
http Sixpines 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 dmz
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 72.54.197.28
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
dhcpd address 192.168.73.101-192.168.73.132 inside
dhcpd dns 192.168.72.14 8.8.8.8 interface inside
dhcpd domain thedavidlawfirm interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
tunnel-group 72.54.197.28 type ipsec-l2l
tunnel-group 72.54.197.28 ipsec-attributes
pre-shared-key
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:
: end
asdm image disk0:/asdm-631.bin
no asdm history enable
OUTPUT of log.....
6      Sep 29 2008      19:31:32      302015      8.8.8.8      53      192.168.1.110      59468      Built outbound UDP connection 2298 for outside:8.8.8.8/53 (8.8.8.8/53) to dmz:192.168.1.110/59468 (192.168.1.110/59468)
6      Sep 29 2008      19:31:30      302016      8.8.8.8      53      192.168.1.110      62740      Teardown UDP connection 2234 for outside:8.8.8.8/53 to dmz:192.168.1.110/62740 duration 0:02:08 bytes 110
THANKS!!!!

Answer 1

Hello –
I know that it has been a while since you’ve posted this question. I just recently ran into the very same situation; trying to get my DMZ to access the internet.
You think that because the internet in a lower security interface, that traffic automatically flows downhill. If you have ANY ACL’s in your DMZ, then this default feature disappears.
If you want to secure your inside from the DMZ, and still get internet, you must do the following:
Second to last ACL :
Action: Deny
Source: any
Destination: inside
Service: IP
Last ACL:
Action: Permit
Source: any
Destination: any
Service: IP
ACL’s read from top to bottom, so in this case, traffic would try to find a match. If traffic was not trying to go into the inside interface, the only other available would be outside.
Thanks,
Michael