08-04-2022 11:48 AM
Dear All,
we've a webserver inside DMZ and did manual NAT for outside access, and it works if its configured as below inputs, but if we change (Source Interface object: DMZ and Destination Interface object: Outside) it won't be accessible. Please advise on the issue.
Type: Static
Source Interface object: Any
Destination Interface object: Any
Original Source: Webserver-Inside-IP
Original Destination: Any (0.0.0.0/0)
Translated Source: Webserver-Public-IP
Translated Destination: Any (0.0.0.0/0)
Regards
08-04-2022 11:58 AM - edited 08-05-2022 05:33 AM
there are dynamic manual NAT above this NAT, make the traffic from DMZ toward OUT dynamic NAT and hence bypass your NAT.
you can do select
before auto NAT
or change the NAT number.
08-05-2022 05:27 AM
are you trying to access the server from the internet or allowing the server access to the internet?
Could you run a packet-tracer and post the result here for review?
packet-tracer input DMZ tcp <real webserver IP> 443 8.8.8.8 443
packet-tracer input Outside tcp 8.8.8.8 443 <real webserver IP> 443
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide