CISCO ASA NAT reflow Solution

Source: Internet
Author: User

In actual cases also encountered this kind of problem, the customer intranet has a server map on the Internet, extranet user access Global-ip no problem, but intranet users want to access Global-ip will not pass, typical is the user will intranet server made public network DNS a record, Both internal and external networks are accessed through domain names.

JUNIPER series equipment including NETSCREEN/ISG/SSG no such problems, directly through the ordinary dip can be achieved, the subsequent product SRX firewall also need to be solved by two-way NAT, the following Cisco ASA to solve this case,juniper The SRX resolution principle is similar.

The hypothetical topologies are as follows:

ASA Intranet network Segment, intranet Web server, corresponding external network Global-ip

Previous implementations of the 8.3IOS version:

Static (inside,inside) TCP 8080 -- Note: The intranet access will be converted to, where the purpose-based conversion is implemented, and then the source address is converted

Acc-list Permit IP host

Nat (inside) acc-list 100

Global (inside) interface--Comment: Convert source address to inside interface address

Same-security-traffic Permit Intra-interface--Comment: Allow interface to forward data simultaneously

8.3IOS version above implementation method:

Same-security-traffic Permit Intra-interface--Comment: Allow interface to forward data simultaneously

Object Network Inside-lan

Subnet --Comment: Define the intranet segment with the name Inside-lan

Object Network Inside-srv

Host Define the intranet Web server with the name Inside-srv

Object Network Global-ip

Host Define an extranet public IP with the name Global-ip

Nat (Inside,inside) source dynamic Inside-lan interface destination static GLOBAL-IP inside-srv-- Note: Source address converted to inside interface address, destination address converted to

Here is an example of one-to-one mapping, port conversion to define object is more troublesome, you can test yourself


This article is from the "Kingjuniper" blog, make sure to keep this source

CISCO ASA NAT reflow Solution

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.