ASA INSIDE to DMZ

[Arthur Rack]

Hi,

I have a topology:

INSIDE: 192.168.1.0/24

OUTSIDE: 200.200.200.1/27

DMZ: 192.168.200.0/24

INSIDE hosts are NATed to OUSTIDE ip address (200.200.200.1)

In DMZ  I have a server with address: 192.168.200.200 wich is NATed to 200.200.200.2

My question is: Is it possible to ping DMZ outside address  (200.200.200.2) from INSIDE hosts ?

[Bogdan Nita]

Yes, but you would need a NAT in place for that.

Something like this:

object network Public_IP
 host x.x.x.x
!
object network DMZ_IP
 host x.x.x.x
!
nat (INSIDE,DMZ) source dynamic any interface destination static Public_IP DMZ_IP

HTH

Bogdan