topic Re: Asterisk Behind ASA with Double NAT issue in Network Security

Asterisk Behind ASA with Double NAT issue

ahmad82pkn — Mon, 11 Mar 2019 21:11:03 GMT

Hi, i am unable to register my softphone on Public IP of my DSL modem 86.87.100.106

i am forwarding all ports from 86.87.100.106 to Firewall outside subnet 192.168.0.18

and then doing static nat of 192.168.0.18 with actual server that is 192.168.165.11

Not sure where i am doing wrong, but not able to register, any thoughts? i know its kind of troubleshooting time, but any hint would be appreciated:)

attached is firewall config + design diagram

Asterisk Behind ASA with Double NAT issue

Collin Clark — Fri, 12 Aug 2011 16:00:35 GMT

What you need to do is put your DSL modem into bridge mode and then put your public IP on the firewall.

Re: Asterisk Behind ASA with Double NAT issue

ahmad82pkn — Fri, 12 Aug 2011 17:19:47 GMT

OK i got command for DHCP (ip address outside dhcp setroute)

so what config would be on ASA outside interface the is connecting to DSL? should i need to assign 86.87.100.106 Internet ip statically to ASA outside interface? or somehow configure DHCP on ASA outside interface?

Re: Asterisk Behind ASA with Double NAT issue

Collin Clark — Fri, 12 Aug 2011 19:04:01 GMT

If it's a static IP assign it to the 'outside' interface. If it's an address you get via DHCP use the command you found above.

Re: Asterisk Behind ASA with Double NAT issue

ahmad82pkn — Fri, 12 Aug 2011 19:08:46 GMT

i just came to know that, DSL router has another LAN interface connected to another ASA, so if i make DSL router in bridge mode, it will break other ASA communication.

ok , so i have to go with port forwarding stuff, ok here is the deal. if i remove

static (m_inside,a_outside) 192.168.0.18 192.168.165.11 netmask 255.255.255.255

and put

static (m_inside,a_outside) udp interface sip 192.168.165.11 sip netmask 255.255.255.255

then phone gets registered on External IP as required, but no RTP voice.

Re: Asterisk Behind ASA with Double NAT issue

ahmad82pkn — Fri, 19 Aug 2011 16:31:18 GMT

Hi Collin, you were right, it reduced one extra nat, and we were good to go thanx for the idea.