Everytime I try to setup my DMZ I keep breaking the internet, can someone help
Hi,
started this on friday at about 5 pm am about at the point of throwing my hands up in the air from frustration. I am trying to configure a dmz for a ip camera to be viewed from the outside. I had tried to set this config to NAT 10.1.35.5 to 2.2.2.14. Immediately after setting up the nat config all hosts on the network lose internet access. After 2 nights of no success, I tried to mimic the port forwarding setup and just forward traffic into the lan rather than trying to get the DMZ working as I could already see a few devices that were setup this way. I feel like I am missing a step while configuring NAT. It seems to me that touching any other the other public IP's tends to mess up the configuration. Is there something I need to do with the existing NATing to free up a public IP from the nat pool? (Sanitized config below)
: Saved
ASA Version 7.0(7)
hostname ASA
domain-name aaa.com
enable password Iliketurtles encrypted
names
dns-guard
interface Ethernet0/0
nameif outside
security-level 0
ip address 2.2.2.2 255.255.255.240
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.1.20.10 255.255.254.0
interface Ethernet0/2
description Test DMZ for web4
shutdown
nameif dmz
security-level 25
ip address 10.1.35.1 255.255.255.0
interface Management0/0
no nameif
no security-level
ip address 192.168.1.1 255.255.255.0
management-only
passwd xxx encrypted
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
object-group service camera tcp-udp
description https2000
port-object range 443 443
port-object range 2000 2005
access-list outside_acl extended permit icmp any any echo-reply
access-list outside_acl extended permit icmp any any time-exceeded
access-list outside_acl extended permit icmp any any unreachable
access-list outside_acl extended permit esp host Virginia host 2.2.2.2
access-list outside_acl extended permit ah host Virginia host 2.2.2.2
access-list outside_acl extended permit udp host Virginia eq isakmp host 2.2.2.2 eq isakmp
access-list outside_acl extended permit udp host Virginia eq 4500 host 2.2.2.2 eq 4500
access-list outside_acl extended permit tcp 100.100.100.0 255.255.255.0 host 2.2.2.10
access-list outside_acl extended permit tcp 100.100.100.0 255.255.255.0 host 2.2.2.11
access-list inside_acl extended permit ip 10.1.20.0 255.255.254.0 any
access-list inside_acl extended permit ip 10.1.24.0 255.255.254.0 any
access-list ltl_irvine_to_va extended permit ip 2.2.2.0 255.255.254.0 any
access-list ltl_irvine_to_va extended permit ip 10.1.24.0 255.255.254.0 any
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.10.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.11.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.250.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.4.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.5.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 10.1.7.0 255.255.255.0
access-list no_nat extended permit ip 10.1.20.0 255.255.254.0 172.16.31.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.10.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.11.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.250.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.4.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.5.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 10.1.7.0 255.255.255.0
access-list no_nat extended permit ip 10.1.24.0 255.255.254.0 172.16.31.0 255.255.255.0
access-list dmz_in extended permit icmp 10.1.35.0 255.255.255.0 any
access-list dmz_in extended permit udp 10.1.35.0 255.255.255.0 10.1.20.0 255.255.254.0 range netbios-ns 139
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 10.1.20.0 255.255.254.0 range 135 netbios-ssn
access-list dmz_in extended permit udp 10.1.35.0 255.255.255.0 10.1.20.0 255.255.254.0 eq domain
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any eq www
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any object-group camera
access-list dmz_in extended permit udp 10.1.35.0 255.255.255.0 10.1.20.0 255.255.254.0
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 10.1.20.0 255.255.254.0
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any eq ftp
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any eq 990
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any range 53000 53010
access-list dmz_in extended permit tcp 10.1.35.0 255.255.255.0 any eq ftp-data
pager lines 24
logging enable
logging timestamp
logging buffered warnings
logging asdm warnings
logging facility 22
mtu outside 1500
mtu inside 1500
mtu dmz 1500
icmp permit any inside
asdm image disk0:/asdm-509.bin
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no_nat
nat (inside) 1 10.1.20.0 255.255.254.0
nat (inside) 1 10.1.24.0 255.255.254.0
nat (dmz) 0 access-list no_nat
nat (dmz) 1 10.1.35.0 255.255.255.0
static (inside,outside) 2.2.2.10 10.1.20.1 netmask 255.255.255.255
static (inside,outside) 2.2.2.11 10.1.20.13 netmask 255.255.255.255
static (dmz,outside) 2.2.2.14 10.1.35.5 netmask 255.255.255.255
static (inside,dmz) 10.1.20.0 10.1.20.0 netmask 255.255.254.0
static (dmz,inside) 10.1.35.0 10.1.35.0 netmask 255.255.255.0
access-group outside_acl in interface outside
access-group inside_acl in interface inside
access-group dmz_in in interface dmz
route outside 0.0.0.0 0.0.0.0 2.2.2.1 1
route inside 10.1.24.0 255.255.254.0 10.1.20.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username admin password blahblahblah encrypted privilege 15
http server enable
http 10.1.4.0 255.255.255.0 outside
http 10.1.5.0 255.255.255.0 outside
http 172.16.31.0 255.255.255.0 outside
http 100.100.100.0 255.255.255.0 outside
http 10.1.24.0 255.255.254.0 inside
http 10.1.20.0 255.255.254.0 inside
http 10.1.5.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside 100 match address ltl_irvine_to_va
crypto map outside 100 set peer Virginia
crypto map outside 100 set transform-set ESP-3DES-SHA
crypto map outside interface outside
isakmp enable outside
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash sha
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
isakmp policy 65535 authentication pre-share
isakmp policy 65535 encryption 3des
isakmp policy 65535 hash sha
isakmp policy 65535 group 2
isakmp policy 65535 lifetime 86400
tunnel-group Virginia type ipsec-l2l
tunnel-group Virginia ipsec-attributes
pre-shared-key *
telnet 10.1.24.93 255.255.255.255 inside
telnet timeout 5
ssh 100.100.100.0 255.255.255.0 outside
ssh timeout 60
console timeout 0
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
Cryptochecksum:c6546262ff82a0b8748f0cbbb189194f
: end
Please add this ACL entry on the "outside_acl"
access-list outside_acl extended permit ip any host 2.2.2.14
let me know, if this helps.
thanks
Similar Messages
-
I need Help Please!
Upgrade as follows:
Upgrading to Snow Leopard
You can purchase Snow Leopard through the Apple Store: Mac OS X 10.6 Snow Leopard - Apple Store (U.S.). The price is $19.99 plus tax. You will be sent physical media by mail after placing your order.
After you install Snow Leopard you will have to download and install the Mac OS X 10.6.8 Update Combo v1.1 to update Snow Leopard to 10.6.8 and give you access to the App Store. Access to the App Store enables you to download Mavericks if your computer meets the requirements.
Snow Leopard General Requirements
1. Mac computer with an Intel processor
2. 1GB of memory
3. 5GB of available disk space
4. DVD drive for installation
5. Some features require a compatible Internet service provider;
fees may apply.
6. Some features require Apple’s iCloud services; fees and
terms apply.
Upgrading to Lion
If your computer does not meet the requirements to install Mavericks, it may still meet the requirements to install Lion.
You can purchase Lion at the Online Apple Store. The cost is $19.99 (as it was before) plus tax. It's a download. You will get an email containing a redemption code that you then use at the Mac App Store to download Lion. Save a copy of that installer to your Downloads folder because the installer deletes itself at the end of the installation.
Lion System Requirements
1. Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7,
or Xeon processor
2. 2GB of memory
3. OS X v10.6.6 or later (v10.6.8 recommended)
4. 7GB of available space
5. Some features require an Apple ID; terms apply.
Upgrading to Mavericks
You can upgrade to Mavericks from Lion or directly from Snow Leopard. Mavericks can be downloaded from the Mac App Store for FREE.
Upgrading to Mavericks
To upgrade to Mavericks you must have Snow Leopard 10.6.8 or Lion installed. Download Mavericks from the App Store. Sign in using your Apple ID. Mavericks is free. The file is quite large, over 5 GBs, so allow some time to download. It would be preferable to use Ethernet because it is nearly four times faster than wireless.
OS X Mavericks- System Requirements
Macs that can be upgraded to OS X Mavericks
1. iMac (Mid 2007 or newer) - Model Identifier 7,1 or later
2. MacBook (Late 2008 Aluminum, or Early 2009 or newer) - Model Identifier 5,1 or later
3. MacBook Pro (Mid/Late 2007 or newer) - Model Identifier 3,1 or later
4. MacBook Air (Late 2008 or newer) - Model Identifier 2,1 or later
5. Mac mini (Early 2009 or newer) - Model Identifier 3,1 or later
6. Mac Pro (Early 2008 or newer) - Model Identifier 3,1 or later
7. Xserve (Early 2009) - Model Identifier 3,1 or later
To find the model identifier open System Profiler in the Utilities folder. It's displayed in the panel on the right.
Are my applications compatible?
See App Compatibility Table - RoaringApps.
You should be sure you have upgraded your hardware if that is required. -
Everytime i try and send a message to my boyfriend through imessage on my ipad, it says "Message send failure" but all of the messages are coming in through my email, i hate texting my boyfriend through my email. So can someone help me, please.
"iMessage allows users to send texts, photos, videos, contact information, and group messages over Wi-Fi or 3G to other iOS 5 users, thus providing an alternative to standard SMS messaging for all users with devices running iOS 5."
This is what it is and what it does. You both have to have iOS 5 installed on your supported device. If that's not what your setup is, then that's your answer. -
i cannot find imported mailboxes. if i try to setup a new mailbox, it shows the existence of the mailboxes under location/on my mac. they do not show up in the mailbox list. where would they be located so that i can retrieve them?
Did you quite Mail and relaunch?
Your imported mail is stored in a new mailbox called “Import.” To reorganize imported messages, create new mailboxes and drag folders and messages from the Import mailbox to other mailboxes. When you’re done, you can delete the Import mailbox.
If you don’t see your mailboxes in Mail, choose View > Show Mailbox List; empty mailboxes aren’t imported. -
Im having major problems syncing my iphone 4 to itunes, this problem started after upgrading to ios 5. I have upgraded my itunes, turned sync by wifi on and off but still nothing. Everytime I try to sync my iphone it just says sync cancelled. Please help.....
I'm having the same problem ! Each time the sync starts it suddenly stops and says finished syncing
-
hi im having huge problems trying to install flash for my mac 10.5 imac, iv gone through the internet and tried all of the solutions, everytime i try to install flash it says cant read the download file, or it just wont install, anybody plz help!
iv unistalled flash, iv checked plug ins it just wont work,It would have been a great help to know precisely what Mac you have, so some of the following may not apply:
You can check here: http://www.adobe.com/products/flash/about/ to see which version you should install for your Mac and OS. Note that version 10,1,102,64 is the last version available to PPC Mac users*. The latest version,10.3.183.23 or later, is for Intel Macs only running Tiger or Leopard, as Adobe no longer support the PPC platform. Version 11.4.402.265 or later is for Snow Leopard onwards.
(If you are running Mavericks: After years of fighting malware and exploits facilitated through Adobe's Flash Player, the company is taking advantage of Apple's new App Sandbox feature to restrict malicious code from running outside of Safari in OS X Mavericks.)
* Unhelpfully, if you want the last version for PPC (G4 or G5) Macs, you need to go here: http://kb2.adobe.com/cps/142/tn_14266.html and scroll down to 'Archived Versions/Older Archives'. Flash Player 10.1.102.64 is the one you download. More information here: http://kb2.adobe.com/cps/838/cpsid_83808.html
You should first uninstall any previous version of Flash Player, using the uninstaller from here (make sure you use the correct one!):
http://kb2.adobe.com/cps/909/cpsid_90906.html
and also that you follow the instructions closely, such as closing ALL applications (including Safari) first before installing. You must also carry out a permission repair after installing anything from Adobe.
After installing, reboot your Mac and relaunch Safari, then in Safari Preferences/Security enable ‘Allow Plugins’. If you are running 10.6.8 or later:
When you have installed the latest version of Flash, relaunch Safari and test.
If you're getting a "blocked plug-in" error, then in System Preferences… ▹ Flash Player ▹ Advanced
click Check Now. Quit and relaunch your browser.
You can also try these illustrated instructions from C F McBlob to perform a full "clean install", which will resolve the "Blocked Plug-in" message when trying to update via the GUI updater from Adobe.
Use the FULL installer for 12.0.0.44: Flash Player 12 (Mac OS X)
And the instructons are here: Snow Leopard Clean Install.pdf
(If you are running a PPC Mac with Flash Player 10.1.102.64 and are having problems with watching videos on FaceBook or other sites, try the following solution which fools the site into thinking that you are running the version 11.5.502.55:)
Download this http://scriptogr.am/nordkril/post/adobe-flash-11.5-for-powerpc to your desktop, unzip it, and replace the current Flash Player plug-in which is in your main/Library/Internet Plug-Ins folder, (not the user Library). Save the old one just in case this one doesn't work. -
my iphone 4 is acting like crap right i can't even restore it everytime i try to reboot it my iphone freezes at the apple logo it is ******* me off to the point where i just want to smash it how do i solve this problem please help?
Don't worry, just follow these steps to fix iPhone stuck on Apple logo
=> First of all Start your Computer and then connect with Internet connection, now Download the latest version of the iTunes application
=> Now install the iTunes application in your System and connect your Device with computer via Data cable
=> Now connect your Device with iTunes application and then Tab on summary option, see in the left side bar of iTunes
=> Now Select restore option from iTunes and then confirm the Restore Message for better results. After this unplug your Device and Restart it
I hope that will surely
Thank you... -
Everytime I try to sync my mac calendar with icloud, the times get switched around and I can't retrieve them. Now I no longer know what time my appointments really are. I have to have my laptop with me in order to check my appointments?! This is driving me crazy. Can anyone help me fix this problem?
Thanks!I'm not sure what you mean by the times get switched around, but you migh check on both mac and device in the Time & Date section of preferences/settings to be sure they are both in the same time zone.
-
My iTunes keeps freezing everytime I try to download a purchased song. Working 10.5.8. Help!
My iTunes keeps freezing everytime I try to download a purchased song. Working 10.5.8. Help!
You may need to update to iTunes 10.7, which would require OS X 10.6.8.
But you can first try to reboot your computer and router/modem -
i recently downloaded itunes 10.3.1 for MAC. BUT everytime I go to help> to try and find the diagnostic options, there is no drop down option for diagnostic? Can someone help?
Why not available in Mac version. We are behind proxy and need this to see why iTunes isn't working?
-
Everytime I try to start my itunes app I get the message " msvcr80.dll missing. try reinstalling the program" I have reistalled itunes several times and this keeps coming up. The msvcr80.dll is on my system. What am I missing? This has only been going on since the last itunes update.
Solving the iTunes Installation Problems in Windows
1. Apple has posted their solution here: iTunes 11.1.4 for Windows- Unable to install or open - MSVCR80 issue.
2. If the Apple article does not fully resolve the problem for you, then try Troubleshooting issues with iTunes for Windows updates - MSVCR80. -
Everytime i go to watch a video on youtube, weather it be the mobile site, desktop version or the app, it always says 'video unavailable on this device' this only started happening in the last few weeks! Can someone help???
Most YouTube content requires the Flash plugin. Sometimes it's necessary to uninstall then reinstall that plugin.
Uninstall the Flash plugin then reinstall new > Troubleshoot Flash Player | Mac OS
Very important to uninstall the currently installed plugin first.
Now launch Safari and try a video.
If you have the ClickToFlash extension installed, that can prevent Flash based video from streaming. It can also be installed as a plugin in /Library/Internet-Plug-Ins.
And check to see if Safari is running in 32 bit mode. Right or control click the Safari icon in your Applications folder then click Get Info. If the box next to: Open in 32 bit mode is selected, deselect, quit then relaunch Safari.
You may also need to delete the cache associated with Safari .
Open the Finder. From the Finder menu bar click Go > Go to Folder
Type or copy/paste: ~/Library/Caches/com.apple.Safari
Click Go the move the Cache.db file from the com.apple.Safari folder to the Trash.
Quit and relaunch Safari. Try a video. -
When I try to send email from my iPad and iPhone it says that I have the wrong username and/or password, but I know they are correct. Can someone help me?
"Your email account" means to tap on the name of your email account. Whatever it is listed as in the settings.
In my mail settings, one of my email accounts is a Comcast account. I tap on the Comcast name and it brings up this window.
Then I tap on the arrow under the Outgoing mail server smtp setting to get to the next window.
In the resulting window, I then tap on the arrow next to the smtp server under the Primary Server setting.
That brings up this window in which I check to make sure that my user name and password have been entered correctly. If those items are missing, enter them in the appropriate fields and then tap done. -
I cannot open itunes. When I try, a popup says I need quicktime 7.5.5 but I cannot download it. Can someone help??
Quicktime 7.5.5 can be downloaded from this link.
http://support.apple.com/downloads/#quicktime -
i recently updated my macbook, i don't know if that has any effect to my recent problem, but when i try to download and save .mp3 files from the internet, like i have done in the past, it downloads but not as an mp3 file, its "blank" and when i try to open it, i can't? I NEED HELP !
Here is the download page
Maybe you are looking for
-
has anyone ran into this problem? I made a phone call and talked for a very short time, but as i went to hang up the call my screen was still black, i couldnt get the phone to responed, i pressed every button and touched the screen, it wouldnt respon
-
"Tape Unthreaded" message when capturing with Canon GL2 using Batch Capture. I noticed that the latest firmware update is now 10.5.7. Could this change be affecting it? Any clues? Thanks!
-
Fade Effect Flickering Problem
I have thumbnail gallery that utilizes the fade effect on the mouseover event. Unfortunately, if the user mouses over the thumbnails too quickly, the images flicker quite horribly. I was wondering if there was a way to remove this problem. Thanks You
-
Download non-english updates from Windows Update Catalog
Hi, I would like to integrate all updates to install image. However, I must select all language of each updates on Windows Updates Catalog each by each. Any idea to download all updates with differance language as easier? thanks
-
when I try to delete old 4s backup from iCloud (I have a 5s) it tells me it cannot be deleted because in use. How to I fix that to delete it?