ASA 5510 - cant access own Public IPs

[ctusa2003am]

Hi,

Having problem with accessing servers/web which are using our own (given by our ISP), but are outside the network.

The company is behind ASA 5510 using E0/2 with Public IP 69.24.x.x (given by our ISP). Inside (E 0/1) being 192.168.1.1 (also the def.gtway for the co.). We do have a router (2901) which connects to the ISP Switch and gives us all the Public IPs.

The problem is when I am accessing a website which is in the DMZ, but can not access from inside our LAN using the public IP. If I try from home/remote, I CAN access that via the Public IP. (will work on DNS etc. afterwards.).

What am I missing?

Thanks,

Ashok

[Philip D'Ath]

Use object NAT and your problem will go away.  Something like:

object network server
  nat (DMZ,any) static 69.24.x.x

[ctusa2003am]

Hi Philip,

Thank you for taking the time. Just one quick point. I do not have any 'DMZ' per say. Just E0/2 physically connected to an Ethernet switch, to which this serer/Webserver in questions (using the public 69.24.x.x IP). That switch connects to the router interface, giving us the IPs. Does this change the statements I have to put.

Thanks,

Ashok

[Philip D'Ath]

If you are just NATing from the outside to the inside then you are stuck.  You have two solutions:

1. Create internal DNS entries to match the external DNS names but pointing to the internal IP addresses.
2. Create a DMZ, and move the servers into it, and use the NAT approach.

[ctusa2003am]

Well the point is well taken on the DNS standpoint, but I am just trying to access via IP only.

What would I have to do for accessing these Public IPs outside, while we are going out through the interface which has the same Public network IP.

Thanks

[Philip D'Ath · Accepted solution]

If you use a DMZ, you can either use a public IP address block on it directly if you one one that can be routed (nicest solution), or a price IP address block and then NAT that to both the outside and inside interfaces (like the example I gave you).

[ctusa2003am]

Thanks again. I followed your suggestions. Created all the NATs in the 2nd ASA. Have a route between them (i.e. 1.0 main and 4.0 'DMZ'.) then on my Domain controller DNS, created Zones and records and now everyone can access those sites via www.dns names.

Hope this is acceptable way of doing this.

Thanks,

Ashok