Solved: Access ASA Internet interface from Internal server

Ramesh M · ‎10-25-2017

Hi Team,

In my perimeter, I have ASA firewall, I need to access the ASA eternal interface IP from the Internal server hosted behind internal interface.

The requirement is my internal VA server should do VA on ASA through public IP. Internal interface is accessible and its working fine.

I am using 9.X version on ASA. Please suggest any workaround to establish the access.

Regards / Ramesh M

Rahul Govindan · ‎10-26-2017

You cannot do this on the ASA itself as the ASA does not allow access to the far-end interface (external) when the source traffic comes in via another interface (internal). This is a security feature and there is no control on the ASA to disable it.
You can possibly use the next hop device to the ASA external to do some policy based routing and destination NAT if it supports both of these features(like a cisco router).

View solution in original post

Rahul Govindan · ‎10-26-2017

You cannot do this on the ASA itself as the ASA does not allow access to the far-end interface (external) when the source traffic comes in via another interface (internal). This is a security feature and there is no control on the ASA to disable it.
You can possibly use the next hop device to the ASA external to do some policy based routing and destination NAT if it supports both of these features(like a cisco router).