I’ve been going round in circles for the last few days trying to accomplish this:

I’ve not had much experience with cisco routers, this is a ASA 5510 running 8.2 (old command structure).

In a nutshell I want to translate a LAN request for one of our external ips to the internal webserver (I think this is also called hair pinning).

We have a block of 8 external IP’s

i.i.i.97, 98, 99, 100, 101, 102, 210, 211

Our interface running config is:

interface Ethernet0/0
nameif OUTSIDE
 security-level 0
 ip address 
interface Ethernet0/1
 nameif INSIDE
 security-level 100
 ip address 
interface Ethernet0/2
 no nameif
 security-level 50
 no ip address
interface Ethernet0/2.23
 vlan 23
 nameif GuestWireless
 security-level 10
 ip address 
interface Ethernet0/3
 no nameif
 no security-level
 no ip address

On the inside I have a server on which I want to expose ports 21, 80, 8000, 8082 to internet clients. However I need internal LAN clients when requesting the external IP i.i.i.98 to be redirected to

I’ve tried lots of guides but run into problems each time, I would be very grateful for some guidance.

Thank you

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 22:36

Any option for split DNS instead (pointing the DNS name to the internal IP on the local DNS server)? Very easy solution.

  • right this is what I was thinking. (just read your answer). – Ronnie Royston Feb 8 '18 at 1:34

It could look as below:

your default dynamic PAT for LAN users to access internet:

global (outside) 1 interface
nat (inside) 1
nat (inside) 1

Than Static NAT for server:

static (inside,outside) [PUBLICIP] [INTERNALIP] netmask

You need enable same security interface traffic:

same-security-traffic permit intra-interface

Than another nat inside to inside:

static (inside,inside) [PUBLICIP] netmask
static (inside,inside) [PUBLICIP] netmask

and just add:

global (inside) 1 interface

That's should be pretty much all. Don't have device on 8.2 to test it.

You may want to check out this or this post.

  • Thanks.. when I try the static (inside,inside) [PUBLICIP] netmask I receive - global address overlaps with mask Any ideas? – Jamie A Feb 11 '17 at 20:31
  • For some reason line breaks do not work??? – Jamie A Feb 11 '17 at 20:32
  • Is your PUBLIC IP included within – Datagram.Network Feb 11 '17 at 20:41
  • no public ip's are all 213.x.x.x – Jamie A Feb 11 '17 at 21:17

Respectfully, I think you're going about it wrong. Web servers are targeted with web addresses, namely, DNS records. So, your server might be mysever.mydomain.com. All you gotta do is set your DNS up appropriately and resolve inside users to the inside address. So, it's a DNS configuration issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.