Not to be pedantic but going from WIRELESS to LAN is not a hairpin as the traffic travels from one interface to another. A hairpin would be from WIRELESS to WIRELESS or from LAN to LAN -- an altogether more challenging problem than what you have requested.
However, to pass traffic from WIRELESS to LAN:
- Since WIRELESS has
security-level 75 to LAN's
security-level 100 ensure that you have an ACL permitting traffic from the real source IP's on WIRELESS to the real IP's on LAN. Regardless of NAT, real IP's are used in ASA 8.3+.
- If you want to use the public IP's of services hosted on LAN from WIRELESS the easiest way is to use the
any keyword for the mapped interface the Object NAT of the server (behind the LAN interface) itself.
! Define object for LAN network and Object NAT dynamic PAT
object network net-10.0.15.0-24
description LAN Network
subnet 10.0.15.0 255.255.255.0
nat (LAN,WAN) dynamic interface
! Define object for WIRELESS and Object NAT dynamic PAT
object network net-10.0.17.0-24
description WIRELESS Network
subnet 10.0.17.0 255.255.255.0
nat (WIRELESS,WAN) dynamic interface
! Define object for a server hosted in LAN, note the *any* in the Object NAT
object network hst-10.0.15.100
description Server on LAN
nat (LAN,any) static 18.104.22.168
! Tweak as needed -- permits WIRELESS to LAN due to security-level difference.
access-list WIRELESS_access_in extended permit ip object net-10.0.17.0-24 object net-10.0.15.0-24
! Beware of implicit deny at end, make sure to configure this ACL properly.
! May have to finish with a permit any any. Included below for reference.
access-list WIRELESS_access_in extended permit ip any any
! Apply the ACL to the interface
access-group WIRELESS_access_in in interface WIRELESS
Be very careful using the
any keyword in Object NAT. Especially with dynamic PAT and dynamic NAT. Read the ASA 8.4 Configuration Guide NAT Section