Configure Access to HTTP Server in DMZ - ISP --> R1--> ASA

[nerervarine]

Hi All,

Noob question:

I have network scenario as represented below, and want to configure access to and from the web server in the dmz (http only). I am confused as to how I do this, I am sure NAT should be done at the Edge Router but since its "outside" interface is a private address, and the network to the ISP Router has only two available IP addresses which are configured for each of the two interfaces. How do I configure the Edge Router to route http packets to the ASA and for it to route them to the web server and back out to the ISP? Thank you!

Thank you

[MHM Cisco World]

object network webserver-external-ip
 host routerToasa subnet ip
!
object network webserver-dmz
 host x.x.x.x
nat (dmz,outside) static webserver-external-ip service tcp www www

Then in router 

Ip nat inside source static tcp <routerToasa subnet ip> <eq www> <isp interface ip> <eq www>

That what you need 

MHM

[nerervarine]

Hi MHM,

Thanks for the response, I just wanted to clarify:

object network webserver-external-ip
host routerToasa subnet ip

Is the above an ip address of the Edge Router interface to ASA, ASA interface to Edge Router or is it a Subnet address like 192.168.70.0

And same question with: ip nat inside source static tcp routerToASA subnet ip ------> is this ip address or subnet address?

Sorry for my confusion and thanks for the response.

[MHM Cisco World]

Sorry If I am not clear 

I meaning one ip form subnet connect asa to router.

And also same 

Ip from subnet connect router to isp

MHM

[nerervarine]

Hi,

Could you tell me how I test this connection, from say the ISP router? I have setup a simple http server in the dmz, as I cannot use the internal IP address, how do I connect and test the connectivity?

Thanks

[MHM Cisco World]

From ISP connect use 

Http edge router IP (this IP i think public ip)

Ip will NATing to asa outside IP (private ip)

Then traffic will NATing again in asa to web ip (private IP).

[nerervarine]

OK - I will try with the IP addresses and report back - thanks for the quick responses.

[nerervarine]

Hi MHM,

I have configured my Network in this way:

ISP int e0/1 -----> 90.241.179.6
Edge Router int e0/0 -----> 90.241.179.5

Edge Router Outside int e0/1 -----> 192.168.70.2
ASA Router Outside int e0/1 -----> 192.168.70.1

DMZ Web Server Address -----> 192.168.60.2

And I have used your suggestions like this:

ON ASA
object network wbs-ext-add
host 90.241.179.5

object network dmz-server
host 192.168.60.2
nat (dmz,outside) static wbs-ext-add service tcp www www

ON EDGE Router
ip nat inside source static tcp 192.168.70.2 www 90.241.179.5 www

But for some reason this isn't working - any help appreciated.

Sorry for the headache!

[MHM Cisco World]

You need to add ip nat inside and ip nat outside to edge router 

You need to add acl allow traffic to web server in dmz

MHM