ASA 8.6 nat reflection

Tarik Admani — Tue, 12 Mar 2019 01:43:27 GMT

Hi,

I have a scenario where i need to enable nat reflection or understand how I can make this work on a ASA 55x5-x for a specific design of telepresence equipment.

There is a equipment that sets inside the network, and its peer (or slave) that sits on the dmz to handle outside connections.

Basically i have to setup up a nat reflection scenario so that the inside appliance only registers to the dmz device using its public natted address and not the dmz address. I have tried to configure this using "same-security-traffic permit intra-interface", static nat for the outside interface which in turn performs an identity nat for the public addresses...

In turn I would like to hairpin this traffic on the outside interface and have it hit the dmz when sourced from the inside and vice versa.

Is this possbile on the 8.6 code? For anyone interested here is a link to the guide that explains this behavior:

http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/config_guide/Cisco_VCS_Basic_Configuration_Control_with_Expressway_Deployment_Guide_X7-2.pdf (page 64)

Thanks,

Tarik Admani
*Please rate helpful posts*

ASA 8.6 nat reflection

Jouni Forss — Fri, 17 May 2013 15:54:26 GMT

Hi,

Not really exactly sure of the setup here. I mean do I understand it correctly.

On first glance it weems to me that you are just talking about NATing DMZ server to their public IP address towards BOTH the "outside" and the "inside"? That shouldnt be a problem to my understanding.

Though in the above case I mention, there is really no hairpinning of traffic involved.

Would there be any chance you could clarify the situation. Perhaps even with a small picture of the network setup along with somekind of example IP addresses?

- Jouni

topic ASA 8.6 nat reflection in Network Security

ASA 8.6 nat reflection

ASA 8.6 nat reflection