ANNOUNCEMENT - The community will be down for maintenace this Thursday August 13 from 12:00 AM PT to 02:00 AM PT. As a precaution save your work.
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1725
Views
0
Helpful
3
Replies
Highlighted
Beginner

Not able to access servers using public ip from internal segment

Hi,

Is it possible to access internal servers using public IP. The server and the client, Both are in inside DMZ.

The server has a static nat.The client uses global IP. ASA 5540 is been used

Regards,

Manish Gupta

Everyone's tags (5)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: Not able to access servers using public ip from internal seg

Yes you can.

Assuming you have the following:

Inside network: 192.168.1.0/24

DMZ network (where the server is): 192.168.5.0/24

Server IP: 192.168.5.5 --> NATed to 200.1.1.5

From the above, I assume you already have the following configured:

static (dmz,outside) 200.1.1.5 192.168.5.5 netmask 255.255.255.255

static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

Assuming that you would like to access the public ip of the server 200.1.1.5 from the inside network, you need to add the following:

static (dmz,inside) 200.1.1.5 192.168.5.5 netmask 255.255.255.255

no sysopt noproxyarp inside

If you have ACL assigned to the inside interface, you would need to allow traffic towards the public ip.

If the above assumption is incorrect, and you have your server in the inside network instead (with ip of 192.168.1.5), and would like to access it from the inside via its public ip, here is the commands:

same-security-traffic permit intra-interface

static (inside,inside) 200.1.1.5 192.168.1.5 netmask 255.255.255.255

global (inside) 1 interface    <-- assuming that you have "nat (inside) 1 0 0" statement.

If you have ACL assigned to the inside interface, you would need to  allow traffic towards the public ip as well.

Hope that helps.

View solution in original post

3 REPLIES 3
Highlighted
Cisco Employee

Re: Not able to access servers using public ip from internal seg

Yes you can.

Assuming you have the following:

Inside network: 192.168.1.0/24

DMZ network (where the server is): 192.168.5.0/24

Server IP: 192.168.5.5 --> NATed to 200.1.1.5

From the above, I assume you already have the following configured:

static (dmz,outside) 200.1.1.5 192.168.5.5 netmask 255.255.255.255

static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

Assuming that you would like to access the public ip of the server 200.1.1.5 from the inside network, you need to add the following:

static (dmz,inside) 200.1.1.5 192.168.5.5 netmask 255.255.255.255

no sysopt noproxyarp inside

If you have ACL assigned to the inside interface, you would need to allow traffic towards the public ip.

If the above assumption is incorrect, and you have your server in the inside network instead (with ip of 192.168.1.5), and would like to access it from the inside via its public ip, here is the commands:

same-security-traffic permit intra-interface

static (inside,inside) 200.1.1.5 192.168.1.5 netmask 255.255.255.255

global (inside) 1 interface    <-- assuming that you have "nat (inside) 1 0 0" statement.

If you have ACL assigned to the inside interface, you would need to  allow traffic towards the public ip as well.

Hope that helps.

View solution in original post

Highlighted
Beginner

Re: Not able to access servers using public ip from internal seg

The issue got resoved after i used a different public IP rather than the default global IP

Highlighted
Cisco Employee

Re: Not able to access servers using public ip from internal seg

Good to hear, and thanks for the update and rating.