Member Avatar for tashiDuks

Hi Everyone,

Recently my organization (where m working) has decided to host web locally rather then hosting in ISP. We have purchased a new server which will be used only for web. My Company has got new public IP for web from ISP i.e. 119.2.116.190.

I am trying to configure web server using Windows 2003 Server for hosting ASP.NET website for our branch office. I have been trying to find a best tutorial for googles but could not find a proper tutorials.

My web server is directly connected to DMZ port of the ASA Firewall which has an IP 255.255.255.255. In the firewall the IP (my server IP) is mapped with my public IP.

Now i want to configure using the above configuration. CAN ANYONE HELP ME HOW TO CONFIGURE. It would be very gratefull if anyone can help me out.\

TashiDuks

  • 2 Contributors
  • 5 Replies
  • 214 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

The posted ASA snippet shows a static NAT and ACLs already in place, so thanks for that — . ’s advice to check logs is spot on. With NAT/ACL present, the usual remaining causes are: server-side networking (gateway/mask/firewall/IIS binding), overlapping or misordered NAT/ACL on the ASA, or the ISP/ASA blocking ICMP (so pings fail even when TCP would work). Work through the checklist below in order.

On the web server — verify basic network and service state. Run these and note any unexpected results:

ipconfig /all
route print
netstat -an | findstr :80
sc query W3SVC

Confirm the server’s default gateway is the ASA DMZ IP, that IIS is actually listening on the DMZ address (or “All Unassigned”), and temporarily allow ICMP/HTTP in Windows Firewall (or briefly disable the firewall) to rule it out.

On the ASA — verify translations, ACL hits and drops. Useful show commands:

show access-list
show xlate
show conn
show logging
show interface

Look for translation entries when you attempt an external connection and for denied packets in the logs. Also check for any broad/static NATs that could overlap the single-host static NAT — overlapping NATs can prevent the right translation from being used. If a DMZ inbound ACL is applied, make sure it isn’t blocking traffic to the ASA or return packets.

From outside test TCP (telnet/curl) to ports 80 and 443 rather than relying on ping — many providers block ICMP. If external TCP works but internal clients can’t reach the public IP, use split-horizon DNS so internal clients resolve the site to the DMZ address. If this doesn’t fix it, post the ASA version plus sanitized outputs of show xlate, show access-list, and the server’s ipconfig /all and netstat so the problem can be narrowed further. Keep any temporary permits limited and remove them when done.

Recommended Answers

All 5 Replies

Member Avatar for CimmerianX

In the ASA, you have the static NAT created. You will also need to create an inbound access list to allow the traffic...

access-list outside_in extended permit tcp any host <public ip mapped to .60> eq 80
access-list outside_in extended permit tcp any host <public ip mapped to .60> eq 443

You will need to point your DNS A record for the website to the new IP address.
You may need to add/reissue a cert for use in the site if you use https.

Member Avatar for CimmerianX

Oops - forgot to mention that you need to apply the acl to the interface and direction of traffic with :

access-group outside_in in interface outside

Member Avatar for tashiDuks

Thanks for your help but the solution which you have given to me is already been configured. Check below:

!
interface GigabitEthernet0/2
 nameif DMZ
 security-level 75
 ip address 30.30.30.10 255.255.255.0
!
access-list acl_outside_in extended permit tcp any host 119.2.116.190
access-list acl_outside_in extended permit icmp any host 119.2.116.190
access-list acl_dmz_in extended permit tcp host 30.30.30.60 any
access-list acl_dmz_in extended permit icmp host 30.30.30.60 any
!
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (DMZ,outside) 119.2.116.190 30.30.30.60 netmask 255.255.255.255
static (DMZ,inside) 30.30.30.0 30.30.30.0 netmask 255.255.255.0
static (inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.0.0
!
access-group acl_outside_in in interface outside
access-group acl_dmz_in in interface DMZ
!

Still then i cannot ping.
Problems:

1. I cannot ping DMZ port from the webserver.
2. I cannot ping the public IP from outside and from inside.

Please help me out.

thanks,

TashiDuks

Member Avatar for tashiDuks

Continuation...

I have checked my host A configuration in DNS, its been already mapped with the public IP. Still i doesnt work.

TashiDuks

Member Avatar for CimmerianX

These lines will help support ICMP echos going in and out.... add them to the ACLs.

for example:
access-list dmz_access_in extended permit icmp any any source-quench
access-list dmz_access_in extended permit icmp any any unreachable
access-list dmz_access_in extended permit icmp any any time-exceeded


Check the ASA log "show logging" or the ASDM home screen. If the ASA is blocking any packets, a drop error will be displayed and/or recorded.

You can also hop on the DMZ web server, open a browser, and check '' It will list your current IP, then you can test back to port 80/443 to see if they are open from the outside.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.