topic and that will redirect in Network Security

how to access internal mail when on guest network

Mike Buyarski — Tue, 12 Mar 2019 07:39:08 GMT

so we recently installed a ASA in place of a router. however now our smart phone users cant get there email on there phone when they are on the guest network.(phone are only allowed on the guest network) I expect this is because the guest network uses external DNS servers so the address of our mail server resolves to the external IP. but that creates the problem since it is going out the same device that it needs to come into. this was not a problem on the router since it just redirected it to the internal address. There must be a way to get this to work through the ASA as well?

you need to do DNS re-write.

Marius Gunnerud — Thu, 21 Apr 2016 15:32:34 GMT

you need to do DNS re-write. you need to add the dns keyword to the end of your NAT statement.

object network MAILSERVER

host 10.10.10.10

nat (inside,outside) static 1.2.3.4 dns

Please remember to select a correct answer and rate helpful posts

and that will redirect

Mike Buyarski — Thu, 21 Apr 2016 16:05:21 GMT

and that will redirect anything trying to hit the external IP from the inside to the inside IP?

What it does is check the NAT

Marius Gunnerud — Thu, 21 Apr 2016 16:25:39 GMT

What it does is check the NAT table and if it finds an entry for the public IP that is returned in the DNS request, it will re-write the public IP to the private IP and send the request to the requesting PC.

Keep in mind that you will need to allow traffic in the ACL to the private IP of the mail server.

Please remember to select a correct answer and rate helpful posts

OK I will try that, and yes I

Mike Buyarski — Thu, 21 Apr 2016 16:37:53 GMT

OK I will try that, and yes I do have the mail server allowed in the ACL for the guest network. Like I said it was working before the ASA was in.

It is because the users are

Marius Gunnerud — Thu, 21 Apr 2016 16:45:10 GMT

It is because the users are receiving the public IP of the server. add the DNS keyword to the end of your NAT statement on the ASA then it should start working again.

Please remember to select a correct answer and rate helpful posts

FYI I will have to do that

Mike Buyarski — Thu, 21 Apr 2016 18:10:10 GMT

FYI I will have to do that change in off hours so I will let you know tomorrow!

Worked great Thanks!

Mike Buyarski — Fri, 22 Apr 2016 16:34:31 GMT

Worked great Thanks!