topic It is a carryover from its in Network Security

Routing Problem

Raimund Schimanovits — Tue, 12 Mar 2019 09:08:00 GMT

Hello

When i want to open a website from the public ip on the firewall the internal LAN i cannot open it.

What`s the problem? Is it not possible to open a connection to a server from the inside to the public IP of the firewall?

From outside everything is working fine.

Thanks

No this is not possible by

Rahul Govindan — Mon, 27 Mar 2017 13:44:22 GMT

No this is not possible by design. You cannot access anything on a far end interface of the ASA when coming in from another interface. This is documented here:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html#29729

Hmmm but what is the probem?

Raimund Schimanovits — Mon, 27 Mar 2017 14:19:37 GMT

Hmmm but what is the probem?

I open a http request to an public IP.

On the outside interface i made a NAT to the Server inside.

The NAT is working perfect when the package comes from the internet. When i open the http request from the inside interface to the public IP from the NAT i get an unreachable.

So the package from the inside went through NAT comes to the outside Interface and goes back to the NAT to the server inside.

Am i right?

Thanks

It is a carryover from its

Rahul Govindan — Mon, 27 Mar 2017 14:43:30 GMT

It is a carryover from its PIX days I believe. Basically the ASA does not allow you to access any resource on any interface if the traffic is sourced from any other interface. These checks happen even before NAT is checked, so it is not a problem with your NAT.

Ok Thanks for the perfect

Raimund Schimanovits — Tue, 28 Mar 2017 07:28:44 GMT

Ok Thanks for the perfect answer. The problem i had is that i alwas have now error messages in the log.

When someone in the network makes a connection to the public ip i had this message.

Deny IP spoof from (xxx.xxxx.xxxx.xxxx) to xxx.xxx.xxx.xxxx on interface outside

then i only can block the ip from inside to outside or do you have a better idea?

Thanks

Yeah the log is shown because

Rahul Govindan — Tue, 28 Mar 2017 10:16:21 GMT

Yeah the log is shown because the inside user gets translated to the same public ip address as the destination, resulting in the Source and destination IP address fields to be the same. You can stop this by applying an ACL on your inside interface to block traffic to the public ip address for your inside users.