ASA 5505 use public IP from inside

[jsd]

I have some services at our corporate network that are published using our public IP. All services works fine from outside our net but I need them to be available from the inside too. I need some directions on how to solve such a problem.

For example: http-traffic to our public IP from the inside must make a u-turn back into my ASA.

Thank you for any clues!

[pstebner1]

Check this doc, about half-way down:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

HTH,

Paul

[sundar.palaniappan]

Jonas,

Paul has provided you the correct link to address your situation. As explained in the link you have two options.

1. DNS doctoring

2. NAT Hairpinning

Either one should work. Choose the solution that's appropriate for your environment.

HTH

Sundar

[jsd]

Thank you guys. Found that link just before I read your posts (should have done some searching first, lazy me...).

As I understand it, I must create statics for each and every service that I want to access from the inside (given the usage of our public IP). Isn't there a way to just say: "All traffic to [outside-ip] from [inside-subnet] shall be hairpinned to [outside-ip]"? Then I can leave all my port forwards as is.

Am I making sense?

[sundar.palaniappan · Accepted solution]

You would have to configure static NAT (inside,inside) for every host/service that you want the ASA redirect the traffic back to the inside interface when the client tries to get to the outside address of the server.

HTH

Sundar

[jsd]

OK, thank you Sundar! That answer my questions.

Interesting that this never was a problem with my previous firewalls from Symantec. I guess it means that those boxes always created an equivalent to static(inside, inside) every time you made a "port forward" behind the scenes.

Again, thanks for fast and helpful answers.