Hairpin from inside to public ip nat to DMZ

toniccomputers.com · ‎10-28-2009

Hello I have an ASA5510 which I am trying to move into production.

Currently I have external, internal, and DMZ interfaces. I have a proxy setup for the inside traffic to get out. I also have a static nat for a DNS server in the DMZ zone. I would like to have the users on the inside interface get to outside public ip of the DNS server not the private one.

inside is 172.16.3.0/24

dmz is 172.16.2.0/24

outside is 208.xxx.xxx.xxx/24

static (dmz,outside) 208.xxx.xxx.xxx 172.16.1.x netmask 255.255.255.255

Collin Clark · ‎10-28-2009

You want to configure Bi-Directional NAT. Here's an excellent article on how to do that.

http://blogs.interfacett.com/mike-storm/2006/6/29/bidirectional-nat-on-a-cisco-pix-or-asa.html

Hope it helps.

Panos Kampanakis · ‎10-28-2009

From what you are describing it seems you want the inside user to use the 208.xxx for the dns. The you will just need

static (dmz,inside) 208.xxx.xxx.xxx 172.16.1.x netmask 255.255.255.255

And of course to open the inside to not drop traffic to the 208.xxx.xxx.xxx

I hope it helps.

PK

toniccomputers.com · ‎10-28-2009

neither of those nat's worked. I still am unable to see the outside address