Access NAT rules on the outside from a DMZ

[Rui Taveira]

Hi,

I have a server "published" to the outside interface with a static NAT.

I've set up a DMZ, and I need it to access that "published" server through it's translated address.

The DMZ has a dynamic NAT rule, using the outside interface IP address.

My access rule for the "published" server is something like:

access-list outside_access_in extended permit tcp any host xxx.xxx.xxx.xxx object-group HTTP-S

xxx.xxx.xxx.xxx is the translated address, and HTTP-S is an object formed by the http and https protocols.

The DMZ has the default access-rules (access-list wireless-guest_access_in extended permit ip any any).

Can anyone help me with this?

Best regards.

[varrao]

Hi,

You might need to add another static command:

static (inside,dmz)  

It should work after that.

Let me know if this work.

Thanks,

Varun

[Rui Taveira]

Thanks for the help, but it doesn't work.

Any other suggestion?

I forgot to mention that the device is an ASA 5520, running 8.2(3).

[varrao]

Hi,

Please provide me the following outputs:

show run nameif

show run nat

show run global

show run static

show run access-list

Thanks,

Varun

[Rui Taveira]

Thanks again for trying to help.

Basicaly, I need that everyone behind the interface "wireless-guest" to access a server on the "inside" interface (xxx.xxx.xxx.xxx), through it's translated address (xxx.xxx.xxx.xxx).

As requested, here is the relevant information:

EDIT: Config ommited.

[varrao]

Hi Rui,

Here's your answer:

static (inside,wireless-guest) 172.16.1.193 212.55.141.25

access-list wireless_access extended permit tcp any host 212.55.141.25

access-group  wireless_access in interface wireless-guest

Let me know if this works for you.

Thanks,

Varun

[Rui Taveira]

That didn't work also.

But I seem to have "fixed" it.

What I did was create a static NAT between the wireless-guest and inside, activated DNS Rewrite on both rules (inside,outside) and (inside,wireless-guest) and turned DNS inspection on.

Thanks for all the help.

[varrao]

Hi Rui,

Great work..... I was not aware of ther dns configuration, but great job.

Thanks,

Varun