topic FMC NAT problem in Network Security

FMC NAT problem

shotalezhava — Wed, 21 Apr 2021 15:57:10 GMT

hello i have website which use my local server services and nat works but this services do not work on local i can not connect to my local outside interface from inside is it nat problem or anything else?

Re: FMC NAT problem

balaji.bandi — Wed, 21 Apr 2021 16:09:40 GMT

if the Server in same IP address of Local network ? how is external party Access using IP or DNS ?

Do you DNS Entry with Local IP address for local user to access

example : external bb.com x.x.x.x - natter to 10.10.10.1 IP address

same DNS entry required local DNS bb.com 10.10.10.1

Re: FMC NAT problem

shotalezhava — Wed, 21 Apr 2021 16:31:26 GMT

my website is not in local but use local services example : my global IP 1.1.1.1 local server 192.168.1.2 i have Nat 1.1.1.1:80 to 192.168.1.2:80 and from outside it works website can tack information from my server but from local : 192.168.1.4 i try to connect 1.1.1.1:80 and it is not working.

Re: FMC NAT problem

Rob Ingram — Thu, 22 Apr 2021 07:53:23 GMT

@shotalezhava

I would expect it to be a nat problem. Can you not connect directly to 192.168.1.2:80 instead of the public IP address?

Re: FMC NAT problem

shotalezhava — Thu, 22 Apr 2021 08:22:54 GMT

From local if connect to 192.168.1.2:80 it is working but it is like stream and website gets stream from my local server so i can not change IP address on my website if i will change it it will not work from outside, if i will give domain to this server and configure local dns that this domain is on 192.168.1.2 it will work?

Re: FMC NAT problem

Rob Ingram — Thu, 22 Apr 2021 08:29:23 GMT

Yes, as already mentioned previously you can use different DNS entry.

From the outside - server.domain.name = 1.1.1.1 and from the inside network - server.domain.name = 192.168.1.2

Re: FMC NAT problem

shotalezhava — Thu, 22 Apr 2021 09:20:12 GMT

Aren't there any other solutions?

Re: FMC NAT problem

Rob Ingram — Thu, 22 Apr 2021 11:06:04 GMT

@shotalezhava

You could use NAT reflection, here is an example for ASA - I imagine it's the same logic when configuring using FTD.