8

I have an ASA5525-X with 9.1.2. On it are several interfaces, but primarily I'm looking at:

(fake subnets)

  • inside 10.0.0.0/24, security level 100
  • outside 10.0.200.0/24, security level 0
  • DMZ 10.0.100.0/24, security level 50

I have a DNS server in DMZ, 10.0.100.1 which I can access from inside without issue. However, I want it to show up as 10.0.200.95 (not a real IP for this example) to people on the internet. I have what I thought was needed for this to work, but when I test it out, the packets are being dropped by the default acl.

Pertinent config pieces:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.0.200.194 255.255.255.192 
interface GigabitEthernet0/6
 nameif DMZ
 security-level 50
 ip address 10.0.100.254 255.255.255.0 
interface GigabitEthernet0/7
 nameif inside
 security-level 100
 ip address 10.0.0.254 255.255.255.0 

object network DMZ-DNS-Server-1
 host 10.0.100.1

nat (inside,outside-backup) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static VPN VPN no-proxy-arp route-lookup
nat (inside,outside) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static VPN VPN no-proxy-arp route-lookup
nat (inside,outside) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup
nat (inside,outside-backup) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup
nat (inside,DMZ) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static DMZ DMZ no-proxy-arp route-lookup
nat (DMZ,outside) source static DMZ DMZ destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup
nat (DMZ,outside-backup) source static DMZ DMZ destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup

object network DMZ-DNS-Server-1
 nat (DMZ,outside) static 10.0.200.195 net-to-net

nat (inside,outside-backup) after-auto source dynamic any interface
nat (inside,outside) after-auto source dynamic any interface
nat (DMZ,outside) after-auto source dynamic any interface
nat (DMZ,outside-backup) after-auto source dynamic any interface


access-list traffic-in-outside extended permit tcp any host 10.0.200.195 eq domain 
access-list traffic-in-outside extended permit udp any host 10.0.200.195 eq domain 
access-group traffic-in-outside in interface outside

Any ideas?

Improve this question
2
  • rest of nat statements have been added. outside-backup is a second internet connection from another provider and is the fall back for internet and vpn access but is not related to this server (no static IP from that side is being used for it).
    – some_guy_long_gone
    Jun 17 '13 at 12:40
  • apologies, I think I edited your comment instead of adding one...
    – some_guy_long_gone
    Jun 17 '13 at 12:41
8

Change your ACL to reference the real address of the server (10.0.100.1) instead of the translated address (10.0.200.195). This is another change in 8.3+. ACLs match on real addresses.

Improve this answer
0
1

You will need to setup a static NAT to do this, since 8.3+ this has changed slightly, in 9 you will want to do it like:

object network STATIC_NAT
 host 10.0.100.1
 nat (DMZ,outside) static 10.0.200.95
Improve this answer
3
  • That's in the config I shared. The ASA broke it into two object network statements with the same name but it was configured same as you have it. My listed config shows "net-to-net" but originally I configured it without that piece and it still didn't work.
    – some_guy_long_gone
    Jun 17 '13 at 12:33
  • Ah ok, have you tried using the packet-tracer command to emulate a packet going through the ASA to see where it's failing?
    – David Rothera
    Jun 17 '13 at 12:36
  • Yes, it states it is being dropped by the default acl which seems to imply that it isn't hitting the acl I created for port 53 at that IP.
    – some_guy_long_gone
    Jun 17 '13 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.