DMZ accesing internal network on ASA

Unanswered Question

Hi people,

in a 5510 ASA I need to install some public servers in DMZ interface, some of them need to get access to internal network, however, I put a static and the access-list to do that, but logging says theres not translation between them (DMZ and Internal) what do I need to do, is there some aditional configuration?

In fac, my servers are working fine with a static and the access-list for them, and they can be accessed form internet with no problem,

can somebody help me please ??


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
sundar.palaniappan Sun, 03/23/2008 - 10:26


Can you post the static and access list you are using.

Which direction are you initiating the traffic - from inside to DMZ or DMZ to inside?

derrickc Tue, 03/25/2008 - 11:22

It looks like the access-list "DMZ_access_in" may have an error. You are permitting the real DMZ IP address to the NAT'd inside address. Wouldn't you want to permit it to the inside server (the one you are trying to communicate with). For example:

access-list DMZ_access_in extended permit ip host host

sundar.palaniappan Tue, 03/25/2008 - 12:10


Yes, as the previous poster indicated you need to permit the host on the DMZ ( to access the device (inside host) in your DMZ ACL. Alternatively, you can configure the DMZ host access the entire inside network as follows.

access-list DMZ_access_in extended permit ip host



cjake7777 Tue, 03/25/2008 - 12:23

It looks like your "static (DMZ,inside) netmask" statement is in error. Its saying that is the same device as I dont think you are trying to do that, take it out, then it should work.

sundar.palaniappan Tue, 03/25/2008 - 12:33

We misunderstood your requirement. It looks like you are trying to get talk to, correct?

If it is then change the static as follows and test.

no static (DMZ,inside) netmask

static (DMZ,inside) netmask

Keep the access list one of two ways.

access-list DMZ_access_in extended permit ip host host


access-list DMZ_access_in extended permit ip host

cjake7777 Tue, 03/25/2008 - 12:48

A way to get around "static (DMZ,inside) netmask" is nat 0 statements. ex:

access-list 100 extended permit ip


nat (inside) 0 access-list 100


I just hate those crazy static statements....Just a suggestion

sundar.palaniappan Tue, 03/25/2008 - 17:14


The static identify nat I had suggested earlier should have worked as well. Did you do a 'clear xlate' after making the configuration change?

As you are probably aware the static identity nat and nat 0 should produce the same result, which is to pass traffic without IP translation.

The following link has examples for both.




This Discussion