CISCO ASA NAT reflow Solution

In actual cases also encountered this kind of problem, the customer intranet has a server map on the Internet, extranet user access Global-ip no problem, but intranet users want to access Global-ip will not pass, typical is the user will intranet server made public network DNS a record, Both internal and external networks are accessed through domain names.

JUNIPER series equipment including NETSCREEN/ISG/SSG no such problems, directly through the ordinary dip can be achieved, the subsequent product SRX firewall also need to be solved by two-way NAT, the following Cisco ASA to solve this case,juniper The SRX resolution principle is similar.

The hypothetical topologies are as follows:

ASA Intranet network Segment 192.168.1.0/24, intranet Web server 192.168.1.250, corresponding external network Global-ip 200.1.1.1

Previous implementations of the 8.3IOS version:

Static (inside,inside) TCP 200.1.1.1 8080 192.168.1.250 -- Note: The intranet access 200.1.1.1 will be converted to 192.168.1.250, where the purpose-based conversion is implemented, and then the source address is converted

Acc-list Permit IP 192.168.1.0 255.255.255.0 host 200.1.1.1

Nat (inside) acc-list 100

Global (inside) interface--Comment: Convert source address to inside interface address

Same-security-traffic Permit Intra-interface--Comment: Allow interface to forward data simultaneously

8.3IOS version above implementation method:

Same-security-traffic Permit Intra-interface--Comment: Allow interface to forward data simultaneously

Object Network Inside-lan

Subnet 192.168.1.0 255.255.255.0 --Comment: Define the intranet segment with the name Inside-lan

Object Network Inside-srv

Host 192.168.1.250--Note: Define the intranet Web server with the name Inside-srv

Object Network Global-ip

Host 200.1.1.1--note: Define an extranet public IP with the name Global-ip

Nat (Inside,inside) source dynamic Inside-lan interface destination static GLOBAL-IP inside-srv-- Note: Source address 192.168.1.0 converted to inside interface address, destination address 200.1.1.1 converted to 192.168.1.250

Here is an example of one-to-one mapping, port conversion to define object is more troublesome, you can test yourself

Kingjuniper

This article is from the "Kingjuniper" blog, make sure to keep this source http://kingjuniper.blog.51cto.com/10445011/1665036

CISCO ASA NAT reflow Solution