0

I am using Cisco ASDM for ASA

I have my internal network called soa. My outside interface is called outside. Let's say my outside IP given to me by my ISP isp is y.y.y.y I have a web server inside my network with a static ip of x.x.x.110. I have configured 2 static nat rules (one for http the other for https).

Source is x.x.x.110. Interface is outside, service (http or https).

Maybe I am doing this wrong, but when I run the packet tracer, I choose outside interface and for the source IP I used 8.8.8.8 and the destination ip is my outside IP address, y.y.y.y

When I run that, it shows the packet traversing successfully, using 9 steps.

For my other test, I switch to the soa interface, input an ip on that network, and leave the destination the same. This test comes up with 2 steps and then fails on my access list.

When I see the rule that fails, it is my catch all which is source: any desitnation: any, service: ip action: deny.

What rule do I need to make to allow my soa network access to go out and come back in by my external IP addess (using a domain name attached to that ip in my dns, of course)?

Improve this question
6
  • 2
    What you are looking for is called NAT Reflection - but I don't know that your device supports it. Alternatively, you'll need to setup split DNS for your network.
    – Grant
    Oct 29, 2012 at 15:31
  • Grant, that is exactly what I need, and it seems CISCO believes it violates the concept of the firewall. AKA, it is not available. Researching NAT reflection led me to the solution of using an internal DNS server that resolves the domain name to the internal IP, or just modifying the hosts file, or, just use the server name internal and know we can't use the domain.
    – Josh
    Oct 29, 2012 at 15:46
  • Indeed, internal DNS servers are the proper way to handle this (or DNS views). You also save on NATing internal traffic (which seems like a waste).
    – gparent
    Oct 29, 2012 at 17:22
  • NATing internal traffic has one advantage - not having to worry about devices getting confused switching between wifi/ethernet and cellular internet.
    – Grant
    Oct 29, 2012 at 22:26
  • What ASA OS version are you using? Also, post all of your NAT related CLI config ( 8.2 and lower "nat", "global", and "static") (8.3 and higher just "nat"). Others are also correct in that you can use split-DNS and not deal with this in the firewall.
    – Weaver
    Nov 1, 2012 at 12:04

3 Answers 3

Reset to default
3

Not sure about Cisco, but on Linux and *BSD this wont work. Even when you try to connect to the external address from the internal network, the packet never passes the external interface as the kernel is too clever, notices his own address and consumes the packet. As the packet never travels through your external interface, the NAT rule for port-forwarding never applies.

Read http://www.openbsd.org/faq/pf/rdr.html#reflect for some (BSD-biased) docs on this.

Improve this answer
2
  • PixOS (Cisco ASA OS) 7.x and newer supports Hairpin NAT. PF can "make" reflection work as well, though it it's overly involved and has some hefty limitations.
    – Chris S
    Oct 30, 2012 at 4:09
  • No. On Linux you can add the NAT rule by IP rather than interface.
    – lqs
    Oct 30, 2012 at 7:45
2

The external NAT look-up from internal LAN's do not work with either BSD or LINUX. However there is a way to cheat Cisco ASA though the best practices suggest that this must not be done. Use if you absolutely need it. The command syntax for Cisco ASA 8.0.x is:

static (dmz,outside) <YOUR-PUBLIC-IP-ADDR> <YOUR-DECLARED-HOST-NAME> netmask 255.255.255.255

static (dmz,inside) <YOUR-PUBLIC-IP-ADDR> <YOUR-DECLARED-HOST-NAME> netmask 255.255.255.255
Improve this answer
1

Accessing internal servers via the public IP address through a NAT router is often called NAT reflection.

Most routers, from your basic home ones up to $1000+ ones support this. Cisco does not.

The best solution is split DNS - where you setup an internal DNS server which has the private IP addresses for your servers instead of the public ones, so clients on the LAN will still have access.

Improve this answer
1
  • 1
    The Cisco ASA does indeed support this feature -- although Cisco generally refers to it as Hairpin NAT, U-turn, or tromboning (like the instrument).
    – Weaver
    Nov 1, 2012 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .