topic ASA-how to access internal server by public address in inside network in Network Security

ASA-how to access internal server by public address in inside network

junxu2 — Mon, 11 Mar 2019 11:25:17 GMT

Hi,

I meet one issue by using ASA5550.

There are 2 interfaces which is configured in firewall, one is acted as inside and other is acted as outside. I configured static PAT from outside to inside and map one public address to internal e-mail server and dynamic PAT frame inside to outside.

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp 212.x.x.1 https 10.x.x.1 https netmask 255.255.255.255

212.x.x.1 is public address which present e-mail server in public network

10.x.x.1 is private address which is e-mail server in private(inside) network

ip address of outside interface is 219.x.x.2/252

1, when I access e-mail server from public network ,it work fine; when I access e-mail server in inside network by using private address 10.x.x.1, it work fine

2, But when I access e-mail server in private(inside) network by using public address 212.x.x.1, it can not work.

I don't know why it is. pls help me to check it.

Thanks

Jun Xu

Re: ASA-how to access internal server by public address in insid

JORGE RODRIGUEZ — Mon, 15 Oct 2007 02:08:33 GMT

you need enabling DNS doctoring or hairpining, refer to this link for more details.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#intro

HTH

Jorge

Re: ASA-how to access internal server by public address in insid

junxu2 — Mon, 15 Oct 2007 05:32:11 GMT

Hi Jorge

Thanks for your reply!

That is good method to solve issue of some applications which used DNS to get ip address. But if some application use public ip address of e-mail server to access in inside world, the problem will be occurred. In customer site , some users just do like this.

How can we solve？

Thanks

Jun

Re: ASA-how to access internal server by public address in insid

JORGE RODRIGUEZ — Mon, 15 Oct 2007 13:30:02 GMT

Jun, go over this thread as there is a conversation on exactly your issue.. you are still looking a hairpinning.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddecce5

Re: ASA-how to access internal server by public address in insid

acomiskey — Mon, 15 Oct 2007 14:44:38 GMT

same-security-traffic permit intra-interface

static (inside,inside) tcp 212.x.x.1 https 10.x.x.1 https netmask 255.255.255.255

global (inside) 1 interface

nat (inside) 1 0 0

Re: ASA-how to access internal server by public address in insid

junxu2 — Thu, 18 Oct 2007 04:15:38 GMT

it is good solution in my customer site.

Thanks all of your help.