problemi access list

[ico78]

Buongiorno a tutti,

sto cercando di far comunicare un pc connesso su rete RSR con indirizzo 138.66.xx.xx con un pc connesso su rete locale con indirizzo 192.168.0.12 aprendo solo le porte che mi interessano 1433 3306 e 5900.
Ho inserito queste linee nel file di configurazione

access-list rsr_access_in extended permit tcp host 138.66.xx.xxhost 192.168.0.12 eq 1433
access-list rsr_access_in extended permit tcp host 138.66.xx.xx host 192.168.0.12 eq 3306
access-list rsr_access_in extended permit tcp host 138.66.xx.xx host 192.168.0.12 eq 5900
access-list rsr_access_in extended permit tcp host 138.66.xx.xx host 192.168.0.12 eq 5800

static (inside,rsr) interface 192.168.0.12 netmask 255.255.255.255

Continuo a non stabilire comunicazione.
Potete aiutarmi, grazie

ciao e buona giornata

[gullio23]

purtroppo se non vedo la conf non posso aiutarti la potresti postare?

cmq gia il nat non mi sembra giusto, ma onde evitare disguidi posta la conf.

ciao
Giulio

[Wizard]

La access-list rsr_access_in disapplicala dalla interfaccia e riprova.
Se così va controlla tutte le acl

[ico78]

Questa è la mia configurazione.
Ho provato a disapplicare ma nulla..

PIX Version 7.1(2)
!
hostname pix1
domain-name areasistema.local
enable password VDfp/IokdTMuiPA9 encrypted
names
name 195.60.xx.xx web1
name 195.60.xx.xx webcluster
name 195.60.xx.xx web2
!
interface Ethernet0
nameif dmz
security-level 40
ip address 195.60.xx.xx 255.255.255.240
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet2
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface Ethernet3
nameif rsr
security-level 50
ip address 138.66.xx.xx 255.255.255.240
!
interface Ethernet4
shutdown
nameif dmz-in
security-level 40
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
passwd xxxxxxxxxxxx encrypted
boot config flash:/running-config-new
ftp mode passive
dns server-group DefaultDNS
domain-name areasistema.local
object-group network clusterweb
network-object web1 255.255.255.255
network-object web2 255.255.255.255
network-object webcluster 255.255.255.255
object-group service vpn tcp
port-object range pptp 1724
access-list dmz_inside extended permit tcp object-group clusterweb host 195.60.xx.xx eq 1238
access-list dmz_inside extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_inside extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_inside extended deny ip any any
access-list dmz_access_in extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in extended deny tcp any any
access-list dmz_access_in_V1 extended permit tcp host web1 interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host webcluster interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host web2 interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in_V1 extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in_V1 extended deny ip any any
access-list dmz_access_in_V2 extended permit tcp object-group clusterweb interface dmz
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.xx host 195.60.xx.xx eq sqlnet
access-list dmz_access_in_V2 extended permit icmp any any
access-list inside_nat0_outbound extended permit ip any 192.168.0.192 255.255.255.224
access-list inside_nat0_outbound extended permit ip host 192.168.0.25 host 10.2.2.1
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.192 255.255.255.224
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.0.240 255.255.255.240
access-list inside_nat0_outbound extended permit ip host 192.168.0.25 host 195.60.xx.xx
access-list test extended permit tcp object-group clusterweb host 195.60.xx.xx eq 1238
access-list dmz_cryptomap_20_1 extended permit ip 192.168.0.0 255.255.255.0 10.2.2.0 255.255.255.0
pager lines 24
logging enable
logging trap informational
logging asdm informational
logging host inside 192.168.0.50
mtu dmz 1500
mtu inside 1500
mtu outside 1500
mtu rsr 1500
mtu dmz-in 1500
ip local pool test 192.168.0.241-192.168.0.250 mask 255.255.255.0
no failover
asdm image flash:/asdm
asdm group clusterweb dmz
no asdm history enable
arp timeout 14400
nat-control
global (dmz) 1 interface
global (outside) 1 interface
global (rsr) 1 interface
global (dmz-in) 1 interface
nat (dmz) 1 195.60.xx.xx 255.255.255.255
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.255.0
route dmz 217.59.xx.xx 255.255.255.248 195.60.xx.xx 1
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
client-firewall none
client-access-rule none
username admin password xxxxxxxxxxxx encrypted
http server enable
http 217.59.xx.xx 255.255.255.255 dmz
http 192.168.0.111 255.255.255.255 inside
http 192.168.0.55 255.255.255.255 inside
http 192.168.0.50 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map dmz_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map dmz_dyn_map 40 set transform-set ESP-3DES-SHA
crypto dynamic-map dmz_dyn_map 60 set transform-set ESP-3DES-SHA
crypto dynamic-map dmz_dyn_map 80 set transform-set ESP-3DES-SHA
crypto dynamic-map dmz_dyn_map 100 set transform-set ESP-3DES-SHA
crypto dynamic-map dmz_dyn_map 120 set transform-set ESP-3DES-SHA
crypto map dmz_map 20 match address dmz_cryptomap_20_1
crypto map dmz_map 20 set peer 217.59.xx.xx
crypto map dmz_map 20 set transform-set ESP-3DES-SHA
crypto map dmz_map 65535 ipsec-isakmp dynamic dmz_dyn_map
crypto map dmz_map interface dmz
isakmp identity address
isakmp enable dmz
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash sha
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
tunnel-group 217.59.xx.xx type ipsec-l2l
tunnel-group 217.59.xx.xx ipsec-attributes
pre-shared-key xxxxxxxxxxxxxxxxxxxxxxx
telnet 192.168.0.55 255.255.255.255 inside
telnet 192.168.0.50 255.255.255.255 inside
telnet 192.168.0.111 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp error
inspect icmp
!
service-policy global_policy global
ssl encryption des-sha1 rc4-md5
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxx
: end

Grazie e buon lavoro

[Wizard]

Dalla configurazione non vedo la regola per il nat statico...

[Shye]

Io non vedo nemmeno l'ACL..

[ico78]

Scusa ho copiato il file sbagliato.

le nuove access-list inserite dopo l'ultima access-list sono

access-list rsr_access_in extended permit tcp host 138.66.xx.xx host 192.168.0.1 eq 1433

static (inside,rsr) 192.168.0.12 192.168.0.12 netmask 255.255.255.255
static (inside,rsr) 192.168.0.1 192.168.0.1 netmask 255.255.255.255

access-group rsr_access_in in interface rsr

grazie

ciao

[Wizard]

access-list rsr_access_in extended permit tcp host 138.66.xx.xx host 192.168.0.1 eq 1433

Ci devi mettere l'ip pubblico come ip destinazione non l'ip interno...