wstegman wrote:
I have a scenario with a load balancer that has connection into the networks behind my ASA's inside and dmz interface. We'll be migrating all the public facing websites currently sitting on the inside to the dmz, but the problem is that I want to move one service over at a time, but my load balancer is of course only able to have one default route. The return traffic from the load balancer to hosts coming from the Internet needs a route back. What's happening is servers on either, not both, of the inside and dmz segments are able to communicate with those connections sourced from the Internet. It leads to an asymmetrical routing issue behind the firewall.
Internet -> ASA - DMZ - WebserversDMZ
| |
inside -- Load Balancer
|
WebserversINSIDE
Is there a way to create a policy nat that states something like
access-list policyNAT perm ip any host WebserversDMZ
nat (outside) 2 access-li policyNAT
global (outside) 2 10.21.5.5 netmask 255.255.255.224
so that return traffic from a server in the DMZ would see it as a directly connected route and use that route for the return traffic instead of its default route? Or does this only work for outbound traffic? I can't see how a static statement would work in this scenario for outside to inside translation.
thank you
Bill
Bill
You can do inbound policy NAT from the outside although from your example it's not entirely clear what you are trying to do. Is 10.21.5.5 meant to be an address on the DMZ ?
Here is an example of inbound policy NAT
access-list PNAT permit ip any host Webserver_dmz
nat (outside) 2 access-list PNAT outside <-- note the additional "outside" keyword at the end, this is important
global (dmz) 2 interface
what the above would do is NAT any source internet addresses to the DMZ interface IP address. So the webserver in the DMZ sees the source as the DMZ interface and just sends it back there.
I'm not entirely sure this is what you want though. If not could you be more specfic in what you want ?
Jon
