Access via IP Global DMZ host

Similar Questions

• VPN access to DMZ host

  I went through the forum messages to allow VPN access to a DMZ host but miss me something and hoping another set of new look will see the question.  Basically, need a VPN profile to allow the service provider to a host in the demilitarized zone.  VPN connects but I can't access the host. Here is the config and Yes its an old Pix 515 running version 7.2 (5) - will get new firewall soon.

  Thank you

  Gary

  PIX Version 7.2 (5)

  !

  !

  interface Ethernet0

  nameif outside

  security-level 0

  IP address xxxx 255.255.255.252

  !

  interface Ethernet1

  nameif inside

  security-level 100

  IP 192.168.254.254 255.255.255.0

  !

  interface Ethernet2

  nameif dmz

  security-level 50

  10.1.1.1 IP address 255.255.255.0

  !

  permit same-security-traffic inter-interface

  outside_access_in list extended access permit icmp any any echo response

  outside_access_in list extended access permit icmp any one time exceed

  access extensive list ip 10.254.253.0 outside_access_in allow 255.255.255.0 host 10.1.1.28

  access extensive list ip 192.168.254.0 inside_outbound_nat0_acl allow 255.255.255.0 10.1.1.0 255.255.255.0

  access extensive list ip 192.168.254.0 inside_outbound_nat0_acl allow 255.255.255.0 10.254.253.0 255.255.255.0

  hvac_splittunnel list standard access allowed host 10.1.1.28

  dmz_nat0_outbound list extended access allowed host ip 10.1.1.28 10.254.253.0 255.255.255.0

  IP local pool hvac 10.254.253.1 - 10.254.253.50 mask 255.255.255.0

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 1 192.168.254.0 255.255.255.0

  NAT (dmz) 0-list of access dmz_nat0_outbound

  NAT (dmz) 1 10.1.1.0 255.255.255.0

  static (dmz, outside) xxxxxx 10.1.1.2 netmask 255.255.255.255

  static (dmz, outside) xxxxxx 10.1.1.3 netmask 255.255.255.255

  static (inside, dmz) 192.168.254.0 192.168.254.0 netmask 255.255.255.0

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 xxxxxxx 1

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-3DES-MD5 value

  life together - the association of security crypto dynamic-map outside_dyn_map 20 seconds 86400

  Crypto-map dynamic outside_dyn_map 20 the value reverse-road

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  ISAKMP crypto identity hostname

  crypto ISAKMP allow outside

  crypto ISAKMP policy 20

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  management-access inside

  dhcpd dns 208.67.222.222 208.67.220.220

  dhcpd ping_timeout 750

  !

  dhcpd address 192.168.254.100 - 192.168.254.200 inside

  dhcpd allow inside

  !

  internal group CVC strategy

  attributes of the hvac group policy

  VPN-idle-timeout 30

  VPN-session-timeout 1440

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list hvac_splittunnel

  hvac xxxx of encrypted password username

  attributes global-tunnel-group DefaultRAGroup

  authentication - server (outer RADIUS) group

  tunnel-group CVC type ipsec-ra

  tunnel-group CVC General attributes

  hvac address pool

  Group Policy - by default-hvac

  tunnel-group CVC ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  Gary,

  Configure "crypto isakmp nat - t" and test it.

  If it still does not work, please download the following information from the configuration, after connecting the customer:

  1 see the isa crypto his

  2 see the crypto ipsec his

  Kind regards

  SIM.

• Vpn client access to the DMZ host

  I'm having a problem where my customers who establish a VPN with Pix 515 cannot access hosts on the DMZ. VPN clients can access hosts inside network without any problems. I discovered that when I make a route to trace from a client computer that has established a VPN connection to a host on the DMZ, he tries to go through the default gateway of computers instead of the client from cisco. Any ideas?

  More information:

  When a client connects with the PIX over the VPN, it is given the internal DNS servers and the DNS Server internal, we have a host entry that says "www.whatever.com" 2.2.2.2 (this is the DMZ host). Customers within the network can access this host with problems, it's just the customers who establish a VPN connection. But the VPN Clients can access "www.whatever.com" using the public ip address. The problem is that if remove us the entry from the host on the DNS server so that the name of "www.whatever.com" decides the public ip address customers inside will not be able to access the DMZ host. The names and IP numbers are not real just using those as an example.

  Any help would be apperciated. Thank you

  You'll currently have something like this in your config file:

  sheep allowed ip access-list

  NAT (inside) 0 access-list sheep

  This tells the PIX not to NAT any traffic from inside interface, which is to go to a VPN client. You need the same thing but for the DMZ interface, then add the following:

  sheep allowed ip access-list

  NAT 0 access-list sheep (dmz)

  Who should you get.

• IPSEC VPN DMZ HOST NAT

  Hello world

  First of all thanks for the invaluable information this community offers technicians everywhere... I'm newish to IPSEC VPN and I have a question.

  I have a DMZ PATed host to a public IP address. I've set up an IPSEC tunnel (with an external body on my outside interface) to allow this host reach a host computer in this organization. The VPN is not come. I am told to implement NAT exemption for the DMZ host IPSEC traffic to the host outside. Kindly, how can I do this?

  Kind regards

  Mumo

  OK, no problem :)

  for 8.2 (5), you can try the following config:

  object network DMZ-net 172.16.1.0 255.255.255.0object network Remote-net 10.1.1.0 255.255.255.0access-list asa_dmz_nat0_outbound extended permit ip object DMZ-net object Remote-netnat (DMZ) 0 access-list asa_dmz_nat0_outbound

• Disable access via RDP client?

  Hi guys,.

  I'm all new to vmware view. Have a good undertanding of vsphere and have now been asked to do a trial of opinion.

  I'll probably ask a lot of questions, probably the most stupid in this forum.

  I have a very operational core facility and was able to access my VD through the client on several different platforms.
  My first question is whether it is actually possible to prevent someone to access the DV via a RDP client and only allow access through VMware View Client?
  Now I can connect through the client view, determine the host name and access via RDP disconnecting as well display the session.

  See you soon

  How about disabling RDP of the OS and that the only available connection connection will be PCOIP - which means he would only come from the customer to view.

• To access the programs at startup, which could be accessed via windows defneder

  I use MSE so Defender is disabled. How to access and modify the programs that run on start up? I can't do this with the disabled Defender.

  • No error message
  • Fact no added software or hardware recently
  • Sought access via the MSE but no luck

  I use MSE so Defender is disabled. How to access and modify the programs that run on start up? I can't do this with the disabled Defender.

  • No error message
  • Fact no added software or hardware recently
  • Sought access via the MSE but no luck

  Do it this way...

  Start button > in the search box, type msconfig > press the Enter key > uac prompt > at the top, click on Startup tab > make changes > click OK when the fact of the advantages of others looking for answers, please mark as answer suggestion if it solves your problem.

• RV042 impossible to disable the DMZ Host

  All trying to configure my RV042, I "turned on" the DMZ host feature (under Configuration > DMZ Host) by entering the address LAN IP of one of our machines. I think now that I don't want to actually on. According to the help page (and also the manual), he says:

  "Enter the IP address of the network device you want to use as a host DMZ." Otherwise, enter a zero (0.0.0.0) to disable the DMZ host.

  So I try to enter the address 0.0.0.0, and it gives me an error:

  

  What I am doing wrong? The instructions are just incorrect? Is there a way to disable this option?

  If the LAN subnet is 192.168.1.x/24, you might want to try instead of 0.0.0.0 192.168.1.0 to disable DMZ Host.

• popular error; An error occurred when opening a virtual disk. Make sure that the converter server and source running machines have network access to the ESX/ESXi hosts source and destination.

  Once again; same problem, others have encountered but nothing seems to work.

  An error occurred when opening a virtual disk. Make sure that the converter server and source running machines have network access to the ESX/ESXi hosts source and destination.

  We have 1 physical servers, we need to see. Here is the environment. All 3 separated location, 3 all firewall separated

  1 physical servers

  -Internal IP address; 172.16.160.21
  -FARM Firewall

  vCenter Server

  -Internal IP address; 172.16.1.85

  -Local Office (ALX)

  Location of destination (ESXi host):

  -Internal IP address; 172.16.153.20

  -Firewall ROOMMATE

  
  Already completed:

  VMware KB: disable SSL on VMware Converter Standalone 5.x encryption   SSL disabled in converter-worker

  Firewall are open / Tunnel is open throughout the environment.

  I have attached the logs.

  Thank you very much

  POCEH; Thanks for the reply. But I wouldn't be pulling my gray hair if I knew what the problem was. I understand that there not for the peer but why...?

• Converter does not have "an error occurred when opening a virtual disk. Verify that the Converter server and source running machines have network access to the ESX/ESXi hosts source and destination. »

  Hi all

  I'm having some trouble converting server physical windows using autonomous vConverter 5.5.

  error message:

  "An error occurred when opening a virtual disk. Verify that the Converter server and source running machines have network access to the ESX/ESXi hosts source and destination. "

  I have attached the bundle newspapers. Please notify.

  See you soon...

  Your error is:

  2014-11 - 04T 18: 27:27.587 - 08:00 [01236 info "Default"] GetManagedDiskName: Get disklib file name as vpxa-nfcssl: / / [a0110-vmgt70-001] WIN-MOVRCVCSITG/WIN-MOVRCVCSITG.vmdk@a0110tesxhyp01.datacenter.telenorservices.com: 902! 2 b 52 87 75 03 03 ff 49-67 2f 3 a 61 76 and 00 cd e1

  2014-11 - 04T 18: 27:27.587 - 08:00 [01236 WARNING 'Default'] [, 0] NfcNewAuthdConnectionEx [NFC ERROR]: unable to connect to peer. Error: Failed to search for host for a0110tesxhyp01.datacenter.telenorservices.com server address: the requested name is valid, but no data of the requested type was found

  2014-11 - 04T 18: 27:27.587 - 08:00 [01236 info "Default"] Sysimgbase_DiskLib_OpenWithPassPhrase failed with 'NBD_ERR_NETWORK_CONNECT' (error code: 2338)

  Check the manual on the required ports.

  HTH

• Access a package Via Select Global variable

  Hi all
  
  I want to access a global variable of the overall package variable IE via a select query. Is it possible or not possible. Please share some entries on this.
  
  Thank you

  Just to clarify that you can reference the global variable if your SQL is itself in PLSQL. It will be linked to.

  CREATE OR REPLACE PACKAGE p1
  AS
    my_global NUMBER := 1;
    --
    FUNCTION f_get_my_global
    RETURN NUMBER;
    --
    PROCEDURE p_do_something;
    --
  END;
  /
  
  CREATE OR REPLACE PACKAGE BODY p1
  AS
    --
    FUNCTION f_get_my_global
    RETURN NUMBER
    AS
    BEGIN
       RETURN my_global;
    END;
    --
    PROCEDURE p_do_something
    AS
      l1 NUMBER;
    BEGIN
      SELECT /*+ find_me */
             my_global
      INTO   l1
      FROM   DUAL;
    END;
    --
  END;
  /
  
  SQL>  exec p1.p_do_something;
  
  PL/SQL procedure successfully completed.
  
  SQL> select sql_text from v$sql where sql_text like '%find_me%';
  
  SQL_TEXT
  --------------------------------------------------------------------------------
  SELECT /*+ find_me */ :B1 FROM DUAL
  
  SQL>
  

• No split tunnel-access internet via isa in dmz

  Hello

  I have configured my asa 5520 v 7.2 for remote VPN. Its works fine. I need to provide my customer internet access without activating split tunnel. I went through a few example below of a doc:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00805734ae.shtml

  the preceding is not enough more me like one have different needs

  I want my client VPN to ASA and access to internet, I had ISA connected to the VPN device. All my vpn clients want access to the internet, it must use this operation to access the internet. My ISA server is in the same subnet of the VPN device by using a different gw for internet access.

  Pls comment

  Add the below: -.

  attributes of the strategy of group staffvpn

  use a MSIE-proxy-server method

  Internet Explorer-proxy server value x.x.x.x

  Disable Internet Explorer-proxy local-bypass

  attributes of the strategy of group staffvpn

  use a MSIE-proxy-server method

  Internet Explorer-proxy server value x.x.x.x

  Disable Internet Explorer-proxy local-bypass

  attributes of the strategy of group newstaffvpn

  use a MSIE-proxy-server method

  Internet Explorer-proxy server value x.x.x.x

  Disable Internet Explorer-proxy local-bypass

  adel username attributes

  use a MSIE-proxy-server method

  Internet Explorer-proxy server value x.x.x.x

  Disable Internet Explorer-proxy local-bypass

  username weppe attributes

  use a MSIE-proxy-server method

  Internet Explorer-proxy server value x.x.x.x

  Disable Internet Explorer-proxy local-bypass

  Remote VPN group no matter what you want to test with. where x.x.x.x is the IP address of the ISA server computer.

  HTH.

• Internal data warehouses DMZ hosts?

  Hi all

  I hope I'm posting in the right section, and this makes sense.

  We currently manage two groups separated, managed by vcenter.  One for all our internal servers and one for our DMZ servers.  We have our guests DMZ nic 1 and nic 2 combined for the console, vmkernel, and data warehouses.  Two of these network adapters are connected to our internal network.  We then nic 3 dmz1 and nic 4 on dmz2.  Each set of network interface cards is assigned its own vswitch.

  Data warehouses for all customers of vm on the DMZ cluster are NFS targets on our internal network of san. Each guest virtual machine is only affected 1 network card with access to it's special DMZ.

  My question is about safety.  We have been operating this way for awhile, but my networks/security guy is concerned that in some way, the virtual machine can be hacked to access all the cards that are connected to the host, or the virtual machine can be hacked and someone might potentially have access to in-house on our SAN data.

  What are the best practices for this scenario?  Should I currently have security vulnerabilities?  Assuming that this configuration is ok, can I give my guy from network to facilitate his concern for information?

  Our san is a Netapp.

  Edit: misspelling of nic4 for dmz2

  Hi SLCSam

  The way I understand how ESXi handles this (and someone please correct me if I'm wrong)

  Is that ESXi handles all the traffic of independent disk of the virtual machine.

  That's why the only VM knows how to send SCSI comarnds to her hyperviser who then rewrote the comarnds and sends it to the virtual disk files.

  This is why each VM has access to its own virtual disk and nothing else on the data store.

  So if one of the VMS is hacked, data on this virtual machine will be on display, but that's all.

  The virtual machines that are running on these clusters are all independent computing environments. And do not have access to each of the other files.

  Consider as turning several independent servers. It cannot write to other discs except via CIFS or similar.

  From what you wrote, you have nic1 and nic2 as a trunk serving admin. and drive networks

  You have 2 different DMZ then nic3 and nic2

  Nic2 therefore seems to be linked to the network disk in the DMZ.

  It is a major problem. Since then, if one of the virtual machines in the DMZ is compromised, VM said could speak to the SAN via NFS (since they are on the same layer 2 network) and this will expose the hard for other virtual machines (possibly internal) files.

  This assumes that there no VLAN involved. Because if the DMZ and the disc of the net are on different VLANS this problem does not occur.

  If it is typo and the network admin and the drive is on nic0 and nic1 or there is configuration of VLANS to separate the traffic of layer 2, then there is no problem with this Setup, even if a virtual DMZ computer is hacked.

  Concerning

  Cyclooctane

• PIX with H & S VPN DMZ hosting web server to the hub

  Ok

  Heres a problem which I think would be quite common for these even remotely conscious of security. Unfortunately, my knowledge of the PIX (as well as other Cisco devices) is still in phase of 'growth '.

  So, here's the problem. I have a WAN put in place with PIXen and SonicWalls, we are set up in a design essentially Hub and Spoke (fine ok so it is partially meshed). We recently decided to pull the trigger on getting a 'real' web site and everything went relatively well that getting up and rolling. (even with my notice of 3 days/deadline), but here's the problem: I set up the web server on the DMZ to the hub pix, and I figured out (the easy part) how to set things so in the Home Office, people can connect to the web server by using the internal address, but I don't know what to do for people in remote offices with VPN home connections. I tried to define static routes, I tried to add the DMZ to the VPN trigger, I tried to do both of the last things together, and I checked that I have rules allowing traffic to the VPN outside the DMZ on the inside. So, what else can I I get?

  I have no problem by configuring a PIX for all basic ups and VPN even at this stage, I can do most of it through the CLI (even if I still want to do more through the PDM). My biggest stumbling block on the PIX has so far was when I actually involve this pesky DMZ...

  I actually two PIX in my office, two for my network domestic (one for my place in the States and one for my place in the Japan), so if you can help me, I'll be the two problems and do not forget to give a rating of excellent reviews!

  so I guess that leaves me to the place where I scream...

  Help!

  and I humbly await your comments.

  the current pix configuration should look at sth like this,

  IP access-list 101 permit

  IP access-list 110 permit

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-md5-hmac superset

  myvpn 10 ipsec-isakmp crypto map

  correspondence address card crypto myvpn 10 110

  card crypto myvpn 10 set by peer

  superset of myvpn 10 transform-set card crypto

  interface myvpn card crypto outside

  ISAKMP allows outside

  ISAKMP key

   address netmask 255.255.255.255
  
  isakmp identity address
  isakmp nat-traversal 20
  isakmp policy 10 authentication pre-share
  isakmp policy 10 encryption 3des
  isakmp policy 10 hash md5
  isakmp policy 10 group 2
  isakmp policy 10 lifetime 86400
  now, to add dmz on top of the existing vpn, add the following to the pix (and apply the same concept on the remote end device)
  access-list 102 permit ip
  access-list 110 permit ip
  nat (dmz) 0 access-list 102
  

• Cannot ping via the VPN client host when static NAT translations are used

  Hello, I have a SRI 3825 configured for Cisco VPN client access.

  There are also several hosts on the internal network of the static NAT translations have a services facing outwards.

  Everything works as expected with the exception that I cannot ping hosts on the internal network once connected via VPN client that is internal IP addresses have the static NAT translations in external public addresses, I ping any host that does not have static NAT translation.

  For example, in the example below, I cannot ping 192.168.1.1 and 192.168.1.2, but I can ping to the internal interface of the router, and any other host on the LAN, I can ping all hosts in the router itself.

  Any help would be appreciated.

  Concerning

  !

  session of crypto consignment

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group vpnclient

  key S3Cu4Ke!

  DNS 192.168.1.1 192.168.1.2

  domain domain.com

  pool dhcppool

  ACL 198

  Save-password

  PFS

  netmask 255.255.255.0

  !

  !

  Crypto ipsec transform-set-SECURE 3DES esp-3des esp-sha-hmac

  !

  Crypto-map dynamic dynmap 10

  86400 seconds, life of security association set

  game of transformation-3DES-SECURE

  market arriere-route

  !

  card crypto client cryptomap of authentication list drauthen

  card crypto isakmp authorization list drauthor cryptomap

  client configuration address card crypto cryptomap answer

  map cryptomap 65535-isakmp ipsec crypto dynamic dynmap

  !

  interface GigabitEthernet0/0

  NAT outside IP

  IP 1.2.3.4 255.255.255.240

  cryptomap card crypto

  !

  interface GigabitEthernet0/1

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  !

  IP local pool dhcppool 192.168.2.50 192.168.2.100

  !

  Note access-list 198 * Split Tunnel encrypted traffic *.
  access-list 198 allow ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

  !
  Note access-list 199 * NAT0 ACL *.
  access-list 199 deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
  access-list 199 permit ip 192.168.1.0 0.0.0.255 any

  !

  Sheep allowed 10 route map
  corresponds to the IP 199

  !
  IP nat inside source map route sheep interface GigabitEthernet0/0 overload

  !

  IP nat inside source static 192.168.1.1 1.2.3.5
  IP nat inside source static 192.168.1.2 1.2.3.6

  The problem seems to be that static NAT take your nat exemption.

  The solution would be:

  IP nat inside source static 192.168.1.1 1.2.3.5 sheep map route
  IP nat inside source static 192.168.1.2 1.2.3.6 sheep map route

  HTH

  Herbert

• Allowing external IP access via VPN Client

  We are looking for our remote VPN users to access an external IP address.  Basically once users authenticate when they try to access 202.1.56.19, they should be out nat through the external interface of the firewall.  Below is out of the package violated on "vpn ecrypt" tracer and as an extract from the config.  On the client, I see that the road to 202.1.56.19 was added, but it does not work.

  Please advise more information be required ing.  Thank you.

  access list INSIDE-OUT scope ip 10.15.160.0 allow 255.255.255.0 any
  access OUTSIDE list / allowed extended Interior ip 10.15.160.0 255.255.255.0 any
  Access-group OUTSIDE / inside interface OUTSIDE-IDC

  NONATIDC list of allowed ip extended access all 10.15.160.0 255.255.255.0

  NAT (INSIDE) 0-list of access NONATIDC
  NAT (INSIDE) 1 10.15.160.0 255.255.255.0
  Global (OUTSIDE-IDC) 1 128.15.155.2

  internal CorpVPN group strategy
  attributes of Group Policy CorpVPN
  value of server DNS 10.15.155.17
  VPN-idle-timeout no
  VPN-session-timeout no
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list SplitTunnel
  something.com value by default-field

  attributes global-tunnel-group CorpVPN
  address pool CorpVPNpool
  Group Policy - by default-CorpVPN
  IPSec-attributes tunnel-group CorpVPN
  pre-shared key

  Standard access list SplitTunnel allow 192.168.168.0 255.255.255.0
  SplitTunnel list standard access allowed host 202.1.56.19

  Packet-trace input outside-iDC tcp 10.15.160.18 22 202.1.56.19 22

  Phase: 1
  Type: ACCESS-LIST
  Subtype:
  Result: ALLOW
  Config:
  Implicit rule
  Additional information:
  MAC access list

  Phase: 2
  Type: FLOW-SEARCH
  Subtype:
  Result: ALLOW
  Config:
  Additional information:
  Not found no corresponding stream, creating a new stream

  Phase: 3
  Type:-ROUTE SEARCH
  Subtype: entry
  Result: ALLOW
  Config:
  Additional information:
  in 0.0.0.0 0.0.0.0 OUTSIDE-IDC

  Phase: 4
  Type: ACCESS-LIST
  Subtype: Journal
  Result: ALLOW
  Config:
  Access-group OUTSIDE / inside interface OUTSIDE-IDC
  access OUTSIDE list / allowed extended Interior ip 10.15.160.0 255.255.255.0 any
  Additional information:

  Phase: 5
  Type: IP-OPTIONS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 6
  Type: CP-PUNT
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 7
  Type: VPN
  Subtype: ipsec-tunnel-flow
  Result: ALLOW
  Config:
  Additional information:

  Phase: 8
  Type: VPN
  Subtype: encrypt
  Result: DECLINE
  Config:
  Additional information:

  Result:
  input interface: OUTSIDE-IDC
  entry status: to the top
  entry-line-status: to the top
  output interface: OUTSIDE-IDC
  the status of the output: to the top
  output-line-status: to the top
  Action: drop
  Drop-reason: flow (acl-drop) is denied by the configured rule

  Essentially, the traffic needs to make a u-turn at ASA outside interface if I understand your configuration.

  You need the following to make it work.

  -permit same-security-traffic intra-interface

  -Host202 of the 10.15.160.0 ip access list permit 255.255.255.0 host 202.1.56.19

  -nat (OUTSIDE-IDC) 1 access-list Host202