0

In my infrastructure, I natted a server on a Public IP address.

Please note, the server is reachable from any outside network.

My access rules are good.

My isssue is from the internal network, I'm not able to reach this Public IP since all traffic by default translates to the outside interface.

Can anyone give me the heads up on this one?

Thank you

Improve this question
3
  • Do I understand it correctly, that you have server and client in the internal network behind NAT? And then, when you tries to ping server from client using external IP, it does not work, because it causes a loop and your packets are dropped? Then probably what you wanted is called 'NAT loopback', but it seems to be not supported by Cisco IOS: supportforums.cisco.com/thread/2198130.
    – Andrey Sapegin
    Feb 20, 2014 at 15:50
  • 1
    @AndreySapegin The ASA line runs PixOS, not IOS. It does support Hairpin NAT.
    – Chris S
    Feb 20, 2014 at 16:01
  • I have the same problem. I turned on dns rewrite so that if the clients inside the network try to contact the server, the dns reply gets modified by the firewall to have the internal (non-nat) ip address instead.
    – ETL
    Feb 20, 2014 at 16:01

1 Answer 1

Reset to default
1

If you already have NAT working correctly, adding same-security-traffic permit intra-interface to your configuration will enable Hairpin NAT (sometimes called Loopback or inside-inside).

Notes:

  • This will allow traffic between interfaces with the same security level; without it you could only go from a higher level to a lower level network (statefully), so there might be security implications of enabling this depending on how your environment is setup now.
  • All traffic to that server will be running through your ASA. This might be a bottleneck. If you have the "Security Plus" license your Eth0/0 and 0/1 are Gigabit ports. The other 3 ports are allways limited to 100Mb, as are all 5 without the license.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .