3

We are using a 5505 ASA Sec+ (8.2). There are three interfaces: inside (172.17.0.0/24), dmz (172.16.0.0/24) and outside (1.2.3.4 for the example).

There are static NAT rules set up translating 1.2.3.4 to servers on the dmz (including 1.2.3.4:80 to 172.16.0.10:80). These work from the outside.

How do I let users on the inside access the DMZ servers using the outside IP in the same way as users on the outside?

Because we are using port address translation (several different servers depending on the port number), I want to avoid DNS doctoring.

It does not matter whether we use NAT or not for direct inside-dmz traffic (most traffic will be through the public IP anyway).

The current NAT configuration:

ASA Version 8.2(5) 

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

global (outside) 1 interface
global (dmz) 2 interface
nat (inside) 1 172.17.0.0 255.255.255.0
nat (dmz) 1 172.16.0.0 255.255.255.0
static (dmz,outside) tcp interface www 172.16.0.10 www netmask 255.255.255.255 
static (dmz,outside) tcp interface https 172.16.0.10 https netmask 255.255.255.255 
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group dmz_access_in in interface dmz

With this minimal configuration, the inside users cannot access the dmz servers at all. Both inside users and dmz servers can access the internet outside just fine, and the dmz servers are accessible from the internet.

Nils
  • 724
  • 1
  • 6
  • 16
  • 1
    Google-hint: what you are trying to do is called `hairpinning` in the docs. – ErikE Jun 28 '15 at 13:47
  • Thanks, I can honestly say I have googled and read about this for several hours now - I might have some faulty configuration preventing me from making it work. Most of the hairpinning resources are for two interfaces with the server being on the same interface as the users, and I haven't gotten it to work using the examples. I tried following the answer at http://serverfault.com/questions/282959/how-do-i-reach-my-internal-server-on-the-external-ip, but the example is only for a single internal IP. – Nils Jun 28 '15 at 13:53
  • 1
    I use DNS rewrite for this. Why isn't that an option for you? – ewwhite Jun 28 '15 at 13:57
  • It might be as a last resort, but DNS rewrite will only work for a single host (since the port number isn't included in the DNS query). We have different servers responding to different port numbers. – Nils Jun 28 '15 at 13:59
  • I have also studied the guide at http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/72273-dns-doctoring-3zones.html#anc15 (see "Alternative solution"), but the relevant config is for ASA version 9 – Nils Jun 28 '15 at 14:04
  • Can't help further I'm afraid, I left the Pix/ASA at 6.3/7. – ErikE Jun 28 '15 at 14:31
  • Ok, I appreciate the effort anyway! I'm not quite ready to give up and move to DNS rewriting :) – Nils Jun 28 '15 at 14:33

1 Answers1

1

I have done this on 8.3+ but I'm a little fuzzy on how we used to do it on 8.2.

I believe it was something like this:

static (dmz,inside) tcp {EXTERNAL IP} www 172.16.0.10 www netmask 255.255.255.255

or with an ACL:

static (dmz,inside) {EXTERNAL IP} ACL1


access-list ACL1 extended ip host 172.16.0.10 {EXTERNAL IP} {EXTERNAL NETMASK}

If that doesn't work I know the following works for 8.3+ so might help you in some way

nat (inside,dmz) source static any interface destination static {External IP} SERVER1 service http http unidirectional no-proxy-arp

object network SERVER1
   host {Internal IP}

nat (dmz,outside) static {External IP}

Now I'm sure I screwed up some part of that so somebody let me know.

Harrison Gibbs
  • 369
  • 1
  • 8