How to access external IPs from inside

[William Reed]

Hello,

We have several servers that we NAT to internal IPs on the inside interface. Normally we just setup DNS on the inside to point to the private IPs.

But I have always been curious, how do you configure the ASA so a host on the inside can talk to a public IP address behind that same ASA?

[Marius Gunnerud]

Do you mean how is the ASA set up so that a host on the outside can access the server on the inside,  or how the ASA is set up so that any host on the inside can access any host on the outside (ie. internet)?

--

Please remember to select a correct answer and rate helpful posts

[nkarthikeyan]

Hi Billy,

You are talking about a scenario... say where a server in dmz zone 10.0.0.100 which is NATed to public IP 1.1.1.1.... say named as testserver.abc.com..... the same server testserver.abc.com should be accessed from inside users say 192.168.100.x using its public ip address right? if so you need to use dns doctoring a kind of hairpinning using NAT....

one of the method is like the below... try this out and let me know if you face any problem....

object network test_public

host 1.1.1.1

!

object network test_private

host 10.0.0.100

!

object network inside_lan

subnet 192.168.100.0 255.255.255.0

!

nat (inside, inside) source dynamic inside_lan interface destination static test_public test_private

!

Make sure you have same security traffic permit intra interface configured

https://supportforums.cisco.com/discussion/12148536/nat-hairpin-dns-rewrite

Regards

Karthik

[Marius Gunnerud]

AAArrrrgggghhh!!! I misread the original post.

But for Karthik's suggestion to work, DNS requests would need to pass through the ASA to a DNS server in either a DMZ or out on the internet.  If DNS requests do not pass through the ASA then you will need to NAT the public IP to the private IP on the inside interface in a hairpinning manner.

Keep in mind that when using DNS doctoring you would need to have an ACL permitting traffic from the internal IP to the private IP of the server if traffic is being denied to the private IP.

For NATing the public IP to the private IP on the inside interface you could do something like the following:

object network SERVER
  host 10.0.0.100 (keeping with Karthik's example ;-)  )

object network LAN
  subnet 192.168.100.0 255.255.255.0

object network SERVER-PUB-IP
  host 1.1.1.1

same-security-traffic permit intra-interface

nat (inside,inside) source static LAN LAN destination static SERVER SERVER-PUB-IP

--

Please remember to select a correct answer and rate helpful posts