topic ASA access from inside to outside interface in Network Security

ASA access from inside to outside interface

andryi — Tue, 12 Mar 2019 01:06:10 GMT

We need to make acces on our ASA device from inside network to outside interface.

The situation is next:

We have public external ip address and we need to access it from our inside network.

Can you please tell me if it is possible to do this?

Thank you.

Re: ASA access from inside to outside interface

Jouni Forss — Tue, 26 Feb 2013 20:15:15 GMT

Hi,

Why do you want to access the public IP address specifically?

If we are talking about mangement of the ASA itself then it would be better to use the users ASA "inside" interface IP address for management connections.

Or what is the purpose of this?

By default to my understanding it should be impossible to access the ASAs interface IP address from an source that is behind another interface.

So for example if you had an host behind "inside" interface which wants to connect to the IP address of the ASAs "outside" interface THEN this should be impossible to my knowledge.

- Jouni

ASA access from inside to outside interface

andryi — Tue, 26 Feb 2013 20:26:10 GMT

There is an internal webserver which can be accessed only from outside interface with port forwarding to internal ip.

. And we need to allow acces to it from our inside network using only external ip.

ASA access from inside to outside interface

Jouni Forss — Tue, 26 Feb 2013 20:41:58 GMT

A bit of a tricky situation.

Usually this is handled with DNS reply rewrite on the ASA. Though if your public IP address isnt associated with some DNS name it wont work.

Can you share what software version your ASA has?

- Jouni

ASA access from inside to outside interface

andryi — Tue, 26 Feb 2013 20:57:36 GMT

No DNS name... only external IP
ASA version 8.2(1)

ASA access from inside to outside interface

Jouni Forss — Tue, 26 Feb 2013 21:07:50 GMT

Hi,

Sadly I am not sure if this is possible in that software.

I got it working on my home ASA5505 but its on software 8.4(5) which has the new NAT configuration format compared to the 8.2.

So I am not really sure if you can configure the same on your current software.

Does your ASA only have "outside" and "inside" interface and the server is located on "inside" interface? Or is there a third interface involved? If the server was behind some "dmz" interface and the users behind "inside" interface then I guess this could be possible in your current software.

- Jouni

ASA access from inside to outside interface

andryi — Tue, 26 Feb 2013 21:17:57 GMT

No... we have only "inside" (with server) and "outside" interfaces, without DMZ

server (LAN) x.x.x.100 - x.x.x.2 inside ASA - y.y.y.58 outside asa - INTERNET
and from x.x.x.x network we need granted access to y.y.y.58 IP

ASA access from inside to outside interface

jocamare — Tue, 26 Feb 2013 22:10:33 GMT

static (inside,inside)

global (inside) 1* interface *Assume you are using number one

same-security-traffic permit intra-interface

ASA access from inside to outside interface

andryi — Wed, 27 Feb 2013 01:08:54 GMT

I guess it will works if the server has public IP. But in our situation it has private IP from 192.168.1.0/24 network.

And If I understand correctly this solution, we need to create a rule that allows to translate external IP to internal IP.

ASA access from inside to outside interface

jocamare — Wed, 27 Feb 2013 01:12:52 GMT

If i understood this correctly you need to access a server that is avaiable only from the outside and that uses port forwarding to get to an internal server, from an internal host.

The suggested solution will work the way you want it, the public IP is going to be the IP address of the outside interface of the ASA. Don't forget the port-forwarding part.

ASA access from inside to outside interface

andryi — Wed, 27 Feb 2013 01:39:54 GMT

Thx, it works. But also we need to change dynamic rule

Used this manual

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

ASA access from inside to outside interface

jocamare — Wed, 27 Feb 2013 01:50:36 GMT

That's right, the solution is named Hairpinning aka U-turn.

The dynamic rule was the one suggested in my first reply:

global (inside) 1* interface *Assume you are using number one - See more at: https://supportforums.cisco.com/message/3867660#3867660

global (inside) 1* interface *Assume you are using number one

ASA access from inside to outside interface

andryi — Wed, 27 Feb 2013 01:55:34 GMT

My mistake.

Thanks so much for help

Re: ASA access from inside to outside interface

Wed, 27 Feb 2013 02:38:47 GMT

Joe,

Just as a hairpinning followup, would you know if it is possible to:

1)manage via asdm the asa from a workstation on inside lan pointing to the outside interface address? We wish to do this because the outside interface is the one that answers to our public dns name which is used in our ssl cert.

2) ping the outside public interface from the LAN behind,the inside private interface?

I have seen numerous threads on this but have not been able to get either of these to work. I am running 8.2.5 with asdm 711. No matter what I try the packet tracer fails when I attempt to do this

Thanks
Harold

Sent from Cisco Technical Support iPad App

Re: ASA access from inside to outside interface

jocamare — Wed, 27 Feb 2013 04:32:04 GMT

Neither of the scenarios you described are going to work because it's a security violation, to try to access the asa's external IP address from an internal host.

There is no way to bypass this.

If you want to manage your asa from the inside just enable the service for the necessary users in that network.

You can add asa's internal IP address to the list of trusted CAs on the manager's computer, that should get rid of the security warning it shows the first time you try to connect.

Re: ASA access from inside to outside interface

Wed, 27 Feb 2013 05:08:16 GMT

Thank you for setting the record straight for me. Any definitive answer to this puts it to rest. That's the magic of this device. The more I think I know the more I find out I don't!

Sent from Cisco Technical Support iPad App