topic Hi again,OK, I think I found in Network Security

Nat rule to access DMZ server from inside with public URL

olipaudex — Tue, 12 Mar 2019 04:41:54 GMT

Hi all,

I'm trying to convert my ASA 8.2 to 8.3 new commands.

I have some NAT rules, which make the possibility for "inside" people to reach a DMZ server with it public URL (www.mydomain.com)

Ex : Inside --> http://www.mydomain.com --> DMZ Web Server

Outside --> http://www.mydomain.com --> DMZ Web Server

My config (8.2 version)

static (dmz,outside) OUT-WEB DMZ-WEB netmask 255.255.255.255
static (dmz,inside) OUT-WEB DMZ-WEB netmask 255.255.255.255

How do it in 8.3 version

Hi again,OK, I think I found

olipaudex — Mon, 01 Sep 2014 09:45:26 GMT

Hi again,

OK, I think I found it

1. solution (normal NAT)

nat (dmz,inside) source static DMZ-WEB OUT-WEB

nat (dmz,outside) source static DMZ-WEB OUT-WEB

2. solution (object NAT)

object network DMZ-WEB
host w.x.y.z

object network OUT-WEB
host a.b.c.d

nat (dmz,outside) static OUT-WEB

With the solution 2., it's impossible to configure 2 nat rules, like I've done in solution 1. I choose the solution 1, much more transparent for me.

Could somebody confirm I'm right.

Thanks

For object NAT you need a

Karsten Iwen — Mon, 01 Sep 2014 14:16:52 GMT

For object NAT you need a different object for every NAT-rule. But all these objects have the same host configured. For reaching your DMZ-server with the public name, you don't need any NAT from inside to DMZ, just DNS-doctoring:

object network DMZ-WEB host a.b.c.d nat (dmz,outside) static OUT-WEB dns

Hi Karsten,OK, another good

olipaudex — Mon, 01 Sep 2014 15:08:36 GMT

Hi Karsten,

OK, another good idea. I will try without the object NAT rule

nat (dmz,outside) source static DNS-WEB OUT-WEB dns

Thanks