Traffic between ASA interfaces

guilherme — Mon, 11 Mar 2019 16:07:47 GMT

Hi,

I have the following scenario:

Outside

ASA--DMZ (valid IP range/28)

Inside (10.0.0.0/20)

I need to set up the ASA so that traffic originating from a DMZ host, with destination being the ASA's outside IP address and port 25/tcp, will be redirected to a server on inside LAN. The problem is that I need to do this WITHOUT using NAT on the DMZ interface to map inside hosts.

NAT rules mapping the inside host to outside interface are working fine if traffic originages from the outside, but if it's from the DMZ just won't work.

Commands "inter-interface" and "intra-interface" are enabled but won't help it since security levels aren't the same.

Any tips?

Regards,

Guilherme

Re: Traffic between ASA interfaces

Yudong Wu — Wed, 19 Aug 2009 20:25:29 GMT

I think you can use static nat like below.

static (inside,DMZ) tcp 25 25

You need add ACL to permit the traffic as well since it is from DMZ to inside.

topic Traffic between ASA interfaces in Network Security

Traffic between ASA interfaces

Re: Traffic between ASA interfaces