topic Re: Configure public IP Pool Cisco ASA 5506 to access internal servers in Network Security

Configure public IP Pool Cisco ASA 5506 to access internal servers

GoldTipu — Sat, 10 Feb 2024 15:01:52 GMT

Dear Team.

I have a Cisco ASA 5506. We have several internal servers that require public access. In addition, we have purchased public IP pool from our Internet Service Provider (ISP).

Currently, we have one WAN ip assigned directly to our WAN interface which we already using to access one internal server .

Could you guide me on configuring the Cisco ASA to enable access to the internal servers using the public IP addresses provided by the ISP?

Also, how will the ISP route traffic to my Cisco ASA WAN?

Re: Configure public IP Pool Cisco ASA 5506 to access internal servers

Rob Ingram — Sat, 10 Feb 2024 17:00:21 GMT

@GoldTipu the ISP needs to route this new public network to the outside interface IP address of your ASA.

From the ASA you then need to create static NATs for your servers using the new public network and define an entry in the ACL permitting the traffic, example:

object network SERVER1
 host 10.1.1.1
 nat (inside,outside) static 123.123.123.1
!
access-list OUTSIDE_IN extended permit tcp any host 10.1.1.1 eq 443
access-list OUTSIDE_IN extended permit tcp any host 10.1.1.1 eq 80

Re: Configure public IP Pool Cisco ASA 5506 to access internal servers

MHM Cisco World — Sat, 10 Feb 2024 17:25:52 GMT

For how ISP routing the traffic toward your ASA' check with ISP it can you need to add interface in same new subnet or the ISP will routing the new subnet toward old WAN IP.

For NATing

You need to add NAT for each server NATing to public IP (from new subnet).

nat (inside,outside) static source object-private-ip object-public-ip

MHM

Re: Configure public IP Pool Cisco ASA 5506 to access internal servers

GoldTipu — Sat, 10 Feb 2024 18:18:34 GMT

@Rob Ingram

Perfect I got it,

I will work on this and get back to you if needed 🙂

Really appreciate your assistance

Thank you 🙂