Hi,
You didnt mention the software level but I would presume since you state that its an old 5505 that it might be running something below 8.3 (which was the software where the NAT format changed). Correct if I am wrong.
I presume that you are using the software level 8.2 and below NAT configuration format.
Below are the basic steps you usually take to implement this
So, at minimum you usually have this configuration
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
Thats your default Dynamic PAT for LAN users Internet traffic
Then you decide to configure a server with its own public IP address using Static NAT
static (inside,outside) 123.456.789.012 192.168.1.244 netmask 255.255.255.255
You then find out that LAN host should also be able to reach this host with the public IP address. And since this isnt supported by the ASA with the above Static NAT alone we would usually have to make sure we have couple of other configurations.
First we enable
same-security-traffic permit intra-interface
This will basicly allow the traffic to enter and leave the same interface on the ASA. This is required for the setup to work.
Now we need to configure a Static NAT from "inside" to "inside" which translates the local IP to public IP
static (inside,inside) 123.456.789.012 192.168.1.244 netmask 255.255.255.255
But this is still not really enough.
This alone would make it possible for the connection from the LAN host to reach the ASA and then the actual server. The problem lies with the fact that the source address is not translated so the server will reply in the 3 way TCP handshake directly to the host while the host will send the last of the 3 messages through ASA and ASA will block it since it didnt see the 2nd message of the 3 way handshake.
Because of this we need to configure Dynamic PAT from "inside" to "inside" also. This is because now each LAN host will be translated to the ASAs "inside" interface IP address and this will make sure that ASA always sees all the required transactions of the TCP connection. This is naturally because the server will see the traffic coming from the ASA interface IP address and will therefore have to forward all traffic through it when the LAN users are connecting to it.
Considering the existing Dynamic PAT above we only add the following command
global (inside) 1 interface
This should pretty much be it. If for some reason "inside" ACL rules are tight then naturally make sure they dont block the connection.
Hope this helps
If this answered your question, please remember to mark the reply as the correct answer
Ask more if needed
- Jouni
