Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Cisco 5510 Router and I can succesfully configure port forwarding from the external interface to a port on an internal address. If I access this from the outside it works correctly, but if I access this from the inside it does not work. How do I make the internal requests resolve correctly?

Specifically I want to make a request to the externalip:external port and have it route to the internalip:internal port regardless of if the request comes from the external interface or the internal interface.

Unfortunately I cannot modify the dns entries, and as such am looking for a way to do this in the address translation of the ASA if possible.

share|improve this question

4 Answers 4

up vote 3 down vote accepted

Even though it is (somewhat painfully) possible with the latest versions of ASA OS, you shouldn't do it. Instead, set up DNS so that the server name is resolved to the external IP when requested externally, and to its internal IP for all systems inside your network.

If the name is in the domain you control, this can be easily accomplished with DNS views. Otherwise, enable DNS Rewrite option for the corresponding static NAT entry as described here.

share|improve this answer
    
Beat me to it. I've found the alias/static command to be very helpful when having a DMZ, but otherwise its not very vell suited. –  pauska Nov 16 '09 at 19:59
    
I understand what you are saying, however the dns is currently not under my control. Could you describe the painfully possible way? –  Superman Nov 16 '09 at 20:12
    
But the firewall is, right? So follow the link and do as it says. –  Max Alginin Nov 16 '09 at 21:33

this response is not very useful because DNS Rewrite does not work with PAT configuration. Any further suggestions?

share|improve this answer

ynguldyn's response is definitely 100% the right answer. You want outside hosts to get the outside IP address, and inside hosts to get the inside IP address.

You can either modify your DNS server or just edit the host files on the PCs, which will be consulted first before the DNS request.

share|improve this answer

If you don't have access to DNS then you could also use a hosts file to point the name to the internal IP address. Or follow this guide for your DMZ setup. It's for the 5505 but it's the same for the 5510

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.