Asterisk Behind ASA with Double NAT issue

[ahmad82pkn]

Hi, i am unable to register my softphone on Public IP of my DSL modem 86.87.100.106

i am forwarding all ports from 86.87.100.106 to Firewall outside subnet 192.168.0.18

and then doing static nat of 192.168.0.18 with actual server that is 192.168.165.11

Not sure where i am doing wrong, but not able to register, any thoughts? i know its kind of troubleshooting time, but any hint would be appreciated:)

attached is firewall config + design diagram

[Collin Clark · Accepted solution]

What you need to do is put your DSL modem into bridge mode and then put your public IP on the firewall.

[ahmad82pkn]

OK i got command for DHCP (ip address outside dhcp setroute)

so what config would be on ASA outside interface the is connecting to DSL? should i need to assign 86.87.100.106 Internet ip statically to ASA outside interface? or somehow configure DHCP on ASA outside interface?

[Collin Clark]

If it's a static IP assign it to the 'outside' interface. If it's an address you get via DHCP use the command you found above.

[ahmad82pkn]

i just came to know that, DSL router has another LAN interface connected to another ASA, so if i make DSL router in bridge mode, it will break other ASA communication.

ok , so i have to go with port forwarding stuff, ok here is the deal. if i remove

static (m_inside,a_outside)  192.168.0.18 192.168.165.11 netmask 255.255.255.255

and put

static (m_inside,a_outside) udp interface sip 192.168.165.11 sip netmask 255.255.255.255

then phone gets registered on External IP as required,  but no RTP voice.

[ahmad82pkn]

Hi Collin, you were right, it reduced one extra nat, and we were good to go thanx for the idea.