Firewall and webserver

Mettete al sicuro la vostra rete!

Moderatore: Federico.Lagni

Rispondi
dannyb
Cisco fan
Messaggi: 40
Iscritto il: mer 25 gen , 2006 11:08 am

Ciao a tutti,

ho un problema con il mio firewall nella pubblicazione di un serverweb, all' interno della mia lan, verso internet (outside). Ho configurato il firewall ma non riesco a capire perchè non riesco a raggiungere il server web.

Vi riporto per maggior chiarezza la configurazione dell' apparato:

ASA Version 7.1(2)
!
hostname ASA-TECH
domain-name server.local
enable password xxxx encrypted
names
name 172.19.1.100 webserver
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 85.xxx.xxx.250 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.50.3.1 255.255.255.0
!
interface Ethernet0/2
nameif dmz
security-level 50
ip address 172.19.1.1 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd xxxxx encrypted
ftp mode passive
clock timezone Italy 1
clock summer-time Italy recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name techlanreti.local
access-list NO-NAT-INSIDE extended permit ip 10.50.3.0 255.255.255.0 172.19.1.0
255.255.255.0
access-list NO-NAT-DMZ extended permit ip 172.19.1.0 255.255.255.0 10.50.3.0 255
.255.255.0
access-list OUT-TO-DMZ remark ACL PER PERMETTERE ACCESSO OUTSIDE-DMZ SU PORTA 80
WEBSERVER
access-list OUT-TO-DMZ extended permit tcp any host webserver eq www
access-list OUT-TO-DMZ extended permit icmp any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
asdm image disk0:/asdm512-k8.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 10.50.3.0 255.255.255.0
nat (dmz) 0 access-list NO-NAT-DMZ
nat (dmz) 1 172.19.1.0 255.255.255.0
static (dmz,outside) tcp 85.xxx.xxx.250 www webserver www netmask 255.255.255.255
access-group OUT-TO-DMZ in interface outside
route outside 0.0.0.0 0.0.0.0 85.xxx.xxx.249 1
route inside 192.168.100.0 255.255.255.0 10.50.3.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username danny password xxxxx encrypted privilege 15
username massimo password xxxx encrypted privilege 15
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 10.50.3.0 255.255.255.0 inside
telnet 0.0.0.0 0.0.0.0 management
telnet timeout 60
ssh 0.0.0.0 0.0.0.0 outside
ssh 10.50.3.0 255.255.255.0 inside
ssh timeout 5
ssh version 1
console timeout 0
management-access inside
dhcpd address 10.50.3.100-10.50.3.250 inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd dns 151.99.125.2 151.99.250.2
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd domain techlanreti.local
dhcpd enable inside
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect pptp
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect esmtp
inspect icmp
!
service-policy global_policy global

Qualcuno di voi riesci a darmi qualche dritta sul perchè non riesco a raggiungere il webserver dall' esterno??

Il server web con ip interno 172.19.1.100 è stato nattato staticamente sull' indirizzo ip pubblico dell' interfaccia outside su porta 80.

Che cosa sbaglio nella configurazione del firewall??

Ciao e grazie,

Danny
Ultima modifica di dannyb il lun 11 set , 2006 3:03 pm, modificato 1 volta in totale.
Top
dannyb
Cisco fan
Messaggi: 40
Iscritto il: mer 25 gen , 2006 11:08 am

dannyb ha scritto:Ciao a tutti,

ho un problema con il mio firewall nella pubblicazione di un serverweb, all' interno della mia lan, verso internet (outside). Ho configurato il firewall ma non riesco a capire perchè non riesco a raggiungere il server web.

Vi riporto per maggior chiarezza la configurazione dell' apparato:

ASA Version 7.1(2)
!
hostname ASA-TECH
domain-name server.local
enable password xxxx encrypted
names
name 172.19.1.100 webserver
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 85.xxx.xxx.250 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.50.3.1 255.255.255.0
!
interface Ethernet0/2
nameif dmz
security-level 50
ip address 172.19.1.1 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd xxxxx encrypted
ftp mode passive
clock timezone Italy 1
clock summer-time Italy recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name techlanreti.local
access-list NO-NAT-INSIDE extended permit ip 10.50.3.0 255.255.255.0 172.19.1.0
255.255.255.0
access-list NO-NAT-DMZ extended permit ip 172.19.1.0 255.255.255.0 10.50.3.0 255
.255.255.0
access-list OUT-TO-DMZ remark ACL PER PERMETTERE ACCESSO OUTSIDE-DMZ SU PORTA 80
WEBSERVER
access-list OUT-TO-DMZ extended permit tcp any host webserver eq www
access-list OUT-TO-DMZ extended permit icmp any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
asdm image disk0:/asdm512-k8.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 10.50.3.0 255.255.255.0
nat (dmz) 0 access-list NO-NAT-DMZ
nat (dmz) 1 172.19.1.0 255.255.255.0
static (dmz,outside) tcp 85.xxx.xxx.250 www webserver www netmask 255.255.255.255
access-group OUT-TO-DMZ in interface outside
route outside 0.0.0.0 0.0.0.0 85.xxx.xxx.249 1
route inside 192.168.100.0 255.255.255.0 10.50.3.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username danny password xxxxx encrypted privilege 15
username massimo password xxxx encrypted privilege 15
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 10.50.3.0 255.255.255.0 inside
telnet 0.0.0.0 0.0.0.0 management
telnet timeout 60
ssh 0.0.0.0 0.0.0.0 outside
ssh 10.50.3.0 255.255.255.0 inside
ssh timeout 5
ssh version 1
console timeout 0
management-access inside
dhcpd address 10.50.3.100-10.50.3.250 inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd dns 151.99.125.2 151.99.250.2
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd domain techlanreti.local
dhcpd enable inside
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect pptp
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect esmtp
inspect icmp
!
service-policy global_policy global

Qualcuno di voi riesci a darmi qualche dritta sul perchè non riesco a raggiungere il webserver dall' esterno??

Il server web con ip interno 172.19.1.100 è stato nattato staticamente sull' indirizzo ip pubblico dell' interfaccia outside su porta 80.

Che cosa sbaglio nella configurazione del firewall??

Ciao e grazie,

Danny
Top
Avatar utente
cisketto
Cisco pathologically enlightened user
Messaggi: 178
Iscritto il: mar 20 dic , 2005 12:02 pm
Località: Milano

qui ci va l'ip pubblico, non quello privato....

access-list OUT-TO-DMZ extended permit tcp any host webserver eq www

Ciao,
Cisketto!
Top
dannyb
Cisco fan
Messaggi: 40
Iscritto il: mer 25 gen , 2006 11:08 am

Ciao cisketto,

grazie mille per la tua tempestiva dritta....ho provato a fare la modifica che mi dicevi tu però non è cambiato nulla...cioè non riesco a visualizzare la pagina web allocata sul webserver. Non è che crea qualche problema il fatto che utilizzo un solo ip pubblico?? Però è corretto pure fare una pat statico su una determinata porta in modo da usare un solo ip pubblico....

Comunque continuo a fare delle prove...qualche idea nel frattempo??

Ciao e grazie mille,

Danny
Top
Rispondi

Torna a “Sicurezza”