Question : Adding an additional public subnet on cisco asa 5510

We're setting up a MS Direct Access Test Lab, and we're pretty much stuck on this problem:


We've created a public_DMZ interface on ethernet0/3 with the first public IP in our new range. We've also set up a vlan for the DMZ which i've connected to one of the nics on the server.

Our problem now is to get the DMZ (on ethernet0/3) to connect to the internet with those public ip's. Our ISP supplied us with this info:

Subnet: 85.xx.xx.96/29
Netmask: 255.255.255.248
Recommended GW-address: 85.xx.xx.97
Your IP-addresses in the subnet: 85.xx.xx.98-102
broadcast ip in subnet 85.xx.xx.103

routed by linknet 82.xx.xx.2/30 (which is the ethernet0/1 device)
your address in linknet: 82.xx.xx.4




Our ASA Configuration:

SA Version 8.0(4)
!
hostname ciscoasa
domain-name nordicsol.local
enable password TPElrzuRXEajseWy encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 nameif internet
 security-level 0
 ip address 82.xxx.95.2 255.255.255.252
 ospf cost 10
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.50.5 255.255.255.0
 ospf cost 10
!
interface Ethernet0/2
 shutdown
 nameif MID
 security-level 100
 ip address 192.168.100.10 255.255.255.0
 ospf cost 10
!
interface Ethernet0/3
 nameif public_DMZ
 security-level 50
 ip address 85.xxx.225.97 255.255.255.248
 ospf cost 10
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 ospf cost 10
 management-only
!
ftp mode passive
dns domain-lookup internet
dns domain-lookup inside
dns domain-lookup management
dns server-group DefaultDNS
 name-server 192.168.50.100
 domain-name nordicsol.local
object-group network DM_INLINE_NETWORK_1
 network-object host 82.xxx.95.2
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service DM_INLINE_SERVICE_1
 service-object tcp
 service-object tcp eq www
access-list outside_access_in extended permit ip host 194.6.238.85 any
access-list outside_access_in extended permit tcp any interface internet eq sip
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq smtp
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 987
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq https
access-list outside_access_in extended permit udp any interface internet eq sip
access-list outside_access_in extended permit udp any object-group DM_INLINE_NETWORK_1 range 9000 9015
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 3478 log disable
access-list outside_access_in extended permit udp any host 82.xxx.95.2 eq 3478 log disable
access-list outside_access_in extended permit ip host 85.xxx.249.246 any
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq ftp
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 4000
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 4001
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 3389
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 4010
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 2224 log disable
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 2222 log disable
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 2221 log disable
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 4030
access-list outside_access_in extended permit object-group TCPUDP any host 82.xxx.95.2 eq www
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any host 82.xxx.95.2
access-list outside_access_in extended permit tcp any host 82.xxx.95.2 eq 2121
access-list nsvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.50.0 255.255.255.0 192.168.25.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.50.0 255.255.255.0 192.168.35.192 255.255.255.224
access-list nsvpn_splitTunnelAcl_1 standard permit 192.168.50.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu internet 1500
mtu inside 1500
mtu MID 1500
mtu management 1500
mtu public_DMZ 1500
ip local pool IP_VPN 192.168.35.201-192.168.35.220 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp deny any internet
icmp permit any public_DMZ
asdm image disk0:/asdm-615.bin
no asdm history enable
arp timeout 14400
nat-control
global (internet) 101 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0
static (inside,internet) tcp interface 2224 192.168.50.100 2224 netmask 255.255.255.255
static (inside,internet) tcp interface 2222 192.168.50.100 2222 netmask 255.255.255.255
static (inside,internet) tcp interface 2221 192.168.50.100 2221 netmask 255.255.255.255
static (inside,internet) tcp interface 987 192.168.50.104 987 netmask 255.255.255.255
static (inside,internet) tcp interface smtp 192.168.50.108 smtp netmask 255.255.255.255
static (inside,internet) tcp interface https 192.168.50.108 https netmask 255.255.255.255
static (inside,internet) tcp interface ftp 192.168.50.100 ftp netmask 255.255.255.255
static (inside,internet) udp interface sip 192.168.50.170 sip netmask 255.255.255.255
static (inside,internet) tcp interface sip 192.168.50.170 sip netmask 255.255.255.255
static (inside,internet) udp interface 9000 192.168.50.170 9000 netmask 255.255.255.255
static (inside,internet) udp interface 9001 192.168.50.170 9001 netmask 255.255.255.255
static (inside,internet) udp interface 9002 192.168.50.170 9002 netmask 255.255.255.255
static (inside,internet) udp interface 9003 192.168.50.170 9003 netmask 255.255.255.255
static (inside,internet) udp interface 9004 192.168.50.170 9004 netmask 255.255.255.255
static (inside,internet) udp interface 9005 192.168.50.170 9005 netmask 255.255.255.255
static (inside,internet) udp interface 9006 192.168.50.170 9006 netmask 255.255.255.255
static (inside,internet) udp interface 9007 192.168.50.170 9007 netmask 255.255.255.255
static (inside,internet) udp interface 9008 192.168.50.170 9008 netmask 255.255.255.255
static (inside,internet) udp interface 9009 192.168.50.170 9009 netmask 255.255.255.255
static (inside,internet) udp interface 9010 192.168.50.170 9010 netmask 255.255.255.255
static (inside,internet) udp interface 9011 192.168.50.170 9011 netmask 255.255.255.255
static (inside,internet) udp interface 9012 192.168.50.170 9012 netmask 255.255.255.255
static (inside,internet) udp interface 9013 192.168.50.170 9013 netmask 255.255.255.255
static (inside,internet) udp interface 9014 192.168.50.170 9014 netmask 255.255.255.255
static (inside,internet) udp interface 9015 192.168.50.170 9015 netmask 255.255.255.255
static (inside,internet) tcp interface 3478 192.168.50.170 3478 netmask 255.255.255.255
static (inside,internet) udp interface 3478 192.168.50.170 3478 netmask 255.255.255.255
static (inside,internet) tcp interface 4000 192.168.50.163 4000 netmask 255.255.255.255
static (inside,internet) tcp interface 4001 192.168.50.163 4001 netmask 255.255.255.255
static (inside,internet) tcp interface 3389 192.168.50.153 3389 netmask 255.255.255.255
static (inside,internet) tcp interface 4010 192.168.50.163 4010 netmask 255.255.255.255
static (inside,internet) tcp interface 4030 192.168.50.163 4030 netmask 255.255.255.255
static (inside,internet) tcp interface www 192.168.50.163 www netmask 255.255.255.255
static (inside,internet) tcp interface 2121 192.168.50.250 2121 netmask 255.255.255.255
access-group outside_access_in in interface internet
route internet 0.0.0.0 0.0.0.0 82.xxx.95.1 255
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable 488
http 193.213.25.215 255.255.255.255 internet
http 88.88.72.217 255.255.255.255 internet
http 192.168.50.0 255.255.255.0 inside
http 195.18.201.1 255.255.255.255 internet
http 192.9.2.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 management
http 88.88.19.156 255.255.255.255 internet
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map internet_map interface internet
crypto isakmp enable internet
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 192.9.2.0 255.255.255.0 inside
ssh 192.168.50.0 255.255.255.0 inside
ssh timeout 50
console timeout 0
dhcpd address 192.168.50.120-192.168.50.125 inside
dhcpd dns 213.184.xxx.1 213.184.xxx.2 interface inside
!
dhcpd address 192.168.100.150-192.168.100.155 MID
dhcpd dns 213.184.xxx.1 213.184.xxx.2 interface MID
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 port 1045
 enable internet
 svc image disk0:/anyconnect-win-2.2.0136-k9.pkg 1
 svc enable
group-policy sslvpnpol internal
group-policy sslvpnpol attributes
 vpn-tunnel-protocol svc
 webvpn
  url-list none
group-policy nsvpn_1 internal
group-policy nsvpn_1 attributes
 dns-server value 192.168.50.xxx
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value nsvpn_splitTunnelAcl_1
 default-domain value nordicsol
group-policy nsvpn internal
group-policy nsvpn attributes
 dns-server value 192.168.50.100
 vpn-tunnel-protocol IPSec webvpn
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value nsvpn_splitTunnelAcl
username sslvpn password /wqkW1nOKnhluDsi encrypted
username nordicsol password zgmiT./VCzXSBlAW encrypted privilege 0
username nordicsol attributes
 vpn-group-policy nsvpn_1
username trine password yEZR/N9aQxehMtwR encrypted
username rolfm password R1bC0Q4OxNyMP4bt encrypted
username rongarlid password CK5VMH06/kZU1SAw encrypted
tunnel-group nsvpn type remote-access
tunnel-group nsvpn general-attributes
 address-pool IP_VPN
 default-group-policy nsvpn_1
tunnel-group nsvpn ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect sip  
  inspect ftp
!
service-policy global_policy global
mount NS type cifs
 server 192.168.50.100
 share software
 domain nordicsol
 username james
 password ********
 status disable
prompt hostname context
Cryptochecksum:7f819e73fa5f1a1f000a45c3f8f1a97a
: end

Answer : Adding an additional public subnet on cisco asa 5510

You have NAT-control enabled so even though you are using public IP addresses on the DMZ servers, you still need to setup NAT through the Firewall.

You can use NAT exemption to keep the same IP addresses when traversing the Firewall.

access-list public_dmz_nat0 extended permit ip 85.xxx.225.96 255.255.255.248 any
nat (public_DMZ) 0 access-list public_dmz_nat0