Hi,
To my understanding there is no supported way of enabling a host behind one interface from accessing another interface of the ASA which is what you seem to be asking.
I have only found an old document that states this limitation
Note
For security purposes the security appliance does not support far-end interface ping, that is pinging the IP address of the outside interface from the inside network.
I guess you would have to somehow make a connection for the network monitoring past the ASA (and natting the source IP address of the monitor server) so the server could reach the external interface while actually connecting to it through that ASAs external interface rather than an internal interface. Naturally this would mean implementing a network setup that might probably be ideal when trying to keep the environment simple.
In the other question I presume you mean is it possible to NAT the actual interface IP address of the ASA? To my understanding this is not possible.
But if your actual firewall is behind another NAT device (as its using private IP address on its external interface) then is there a need to do anything special on this firewall? Wouldnt the device infront of the ASA handle the required NAT for the ASA to be able to monitor remote hosts for the purpose of tracking?
- Jouni
