Cisco ASA 5510 IP Hairpin NAT

Question

I’ve been going round in circles for the last few days trying to accomplish this:

I’ve not had much experience with cisco routers, this is a ASA 5510 running 8.2 (old command structure).

In a nutshell I want to translate a LAN request for one of our external ips to the internal webserver (I think this is also called hair pinning).

We have a block of 8 external IP’s

i.i.i.97, 98, 99, 100, 101, 102, 210, 211

Our interface running config is:

interface Ethernet0/0
nameif OUTSIDE
 security-level 0
 ip address 213.106.251.100 255.255.255.248 
!
interface Ethernet0/1
 nameif INSIDE
 security-level 100
 ip address 10.22.16.25 255.255.240.0 
!
interface Ethernet0/2
 no nameif
 security-level 50
 no ip address
!
interface Ethernet0/2.23
 vlan 23
 nameif GuestWireless
 security-level 10
 ip address 172.22.225.1 255.255.255.0 
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address

On the inside I have a server on 10.22.16.34 which I want to expose ports 21, 80, 8000, 8082 to internet clients. However I need internal LAN clients when requesting the external IP i.i.i.98 to be redirected to 10.22.16.34

I’ve tried lots of guides but run into problems each time, I would be very grateful for some guidance.

Thank you

Answer 1

Any option for split DNS instead (pointing the DNS name to the internal IP on the local DNS server)? Very easy solution.

Answer 2

It could look as below:

your default dynamic PAT for LAN users to access internet:

global (outside) 1 interface
nat (inside) 1 10.22.16.0 255.255.240.0
nat (inside) 1 172.22.225.0 255.255.255.0

Than Static NAT for server:

static (inside,outside) [PUBLICIP] [INTERNALIP] netmask 255.255.255.255

You need enable same security interface traffic:

same-security-traffic permit intra-interface

Than another nat inside to inside:

static (inside,inside) [PUBLICIP] 10.22.16.0 netmask 255.255.240.0
static (inside,inside) [PUBLICIP] 172.22.225.0 netmask 255.255.255.0

and just add:

global (inside) 1 interface

That's should be pretty much all. Don't have device on 8.2 to test it.

You may want to check out this or this post.

Answer 3

Respectfully, I think you're going about it wrong. Web servers are targeted with web addresses, namely, DNS records. So, your server might be mysever.mydomain.com. All you gotta do is set your DNS up appropriately and resolve inside users to the inside address. So, it's a DNS configuration issue.