Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Cisco ASDM for ASA

I have my internal network called soa. My outside interface is called outside. Let's say my outside IP given to me by my ISP isp is y.y.y.y I have a web server inside my network with a static ip of x.x.x.110. I have configured 2 static nat rules (one for http the other for https).

Source is x.x.x.110. Interface is outside, service (http or https).

Maybe I am doing this wrong, but when I run the packet tracer, I choose outside interface and for the source IP I used 8.8.8.8 and the destination ip is my outside IP address, y.y.y.y

When I run that, it shows the packet traversing successfully, using 9 steps.

For my other test, I switch to the soa interface, input an ip on that network, and leave the destination the same. This test comes up with 2 steps and then fails on my access list.

When I see the rule that fails, it is my catch all which is source: any desitnation: any, service: ip action: deny.

What rule do I need to make to allow my soa network access to go out and come back in by my external IP addess (using a domain name attached to that ip in my dns, of course)?

share|improve this question
2  
What you are looking for is called NAT Reflection - but I don't know that your device supports it. Alternatively, you'll need to setup split DNS for your network. –  Grant Oct 29 '12 at 15:31
    
Grant, that is exactly what I need, and it seems CISCO believes it violates the concept of the firewall. AKA, it is not available. Researching NAT reflection led me to the solution of using an internal DNS server that resolves the domain name to the internal IP, or just modifying the hosts file, or, just use the server name internal and know we can't use the domain. –  Josh Oct 29 '12 at 15:46
    
Thanks I've posted it as an answer. –  Grant Oct 29 '12 at 17:21
    
Indeed, internal DNS servers are the proper way to handle this (or DNS views). You also save on NATing internal traffic (which seems like a waste). –  gparent Oct 29 '12 at 17:22
    
NATing internal traffic has one advantage - not having to worry about devices getting confused switching between wifi/ethernet and cellular internet. –  Grant Oct 29 '12 at 22:26
show 1 more comment

3 Answers

up vote 3 down vote accepted

Not sure about Cisco, but on Linux and *BSD this wont work. Even when you try to connect to the external address from the internal network, the packet never passes the external interface as the kernel is too clever, notices his own address and consumes the packet. As the packet never travels through your external interface, the NAT rule for port-forwarding never applies.

Read http://www.openbsd.org/faq/pf/rdr.html#reflect for some (BSD-biased) docs on this.

share|improve this answer
    
PixOS (Cisco ASA OS) 7.x and newer supports Hairpin NAT. PF can "make" reflection work as well, though it it's overly involved and has some hefty limitations. –  Chris S Oct 30 '12 at 4:09
    
No. On Linux you can add the NAT rule by IP rather than interface. –  lqs Oct 30 '12 at 7:45
add comment

The external NAT look-up from internal LAN's do not work with either BSD or LINUX. However there is a way to cheat Cisco ASA though the best practices suggest that this must not be done. Use if you absolutely need it. The command syntax for Cisco ASA 8.0.x is:

static (dmz,outside) <YOUR-PUBLIC-IP-ADDR> <YOUR-DECLARED-HOST-NAME> netmask 255.255.255.255

static (dmz,inside) <YOUR-PUBLIC-IP-ADDR> <YOUR-DECLARED-HOST-NAME> netmask 255.255.255.255
share|improve this answer
add comment

Accessing internal servers via the public IP address through a NAT router is often called NAT reflection.

Most routers, from your basic home ones up to $1000+ ones support this. Cisco does not.

The best solution is split DNS - where you setup an internal DNS server which has the private IP addresses for your servers instead of the public ones, so clients on the LAN will still have access.

share|improve this answer
    
The Cisco ASA does indeed support this feature -- although Cisco generally refers to it as Hairpin NAT, U-turn, or tromboning (like the instrument). –  Weaver Nov 1 '12 at 12:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.