Hi, I tried that beforehand. But didnt work. The following is the configuration i have in my ASA.

access-list inbound extended permit icmp any any
access-list inbound extended permit ip any any

access-list nonat extended permit ip any host 172.16.1.20

global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 172.16.1.0 255.255.255.0

access-group inbound in interface outside

All the clients have internet access. But i cannot ping or connect to the 172.16.1.20 machine.

Any idea..?

Are the servers ever going to go out from the inside and get translated to the public IP on your outside interface ?

If they are do you know the specific source IPs you want to use to be able to access the servers on their private addresses from outside ?

Jon

No.. These servers are going to remain private. And there wont be any mapping from outside interface to the private IP address of the server.

Thats why i want some way to access the server using the private IP address, rather than using the mapped IP address.

Nimalraj

That did the trick for me.

can you elobrate more about this command. The reason i am asking is, it worked without even Nat0 command.

thats why i am bit confused.

Cheers

nimalrajphilips wrote:
That did the trick for me.
can you elobrate more about this command. The reason i am asking is, it worked without even Nat0 command.
thats why i am bit confused.
Cheers

Basically it is a static NAT statement that takes precedence over your dynamic NAT statements. Usually you see something like -

static (inside,outside) 195.17.10.10 192.168.5.10 netmask 255.255.255.255

where you are natting the private IP of 192.168.5.10 on the inside to the public IP of 195.17.10.10 on the outside. Yes the (inside,outside) are the wrong way round compared to IOS but you get used to it

Using a static NAT allows connections to be initiated from the outside to the inside. With your example ie.

static (inside,outside) 172.16.10.0 172.16.10.0 netmask 255.255.255.0

we are simply saying present the 172.16.10.x addresses to the outside as 172.16.10.x.

Note that on other vendors firewalls you wouldn't need this statement if the addresses you present are the same as the real addresses as in your scenario but this is another quirk of the Cisco Pix/ASA firewalls.

Jon

Thanks alot Jon.

When you use the NAT exemption method, your ACL is the other way round.

You have "access-list nonat extended permit ip any host 172.16.1.20" configured. It should have been "access-list nonat extended permit ip host 172.16.1.20 any"

However, as Jon's suggestion, you can also use the static to itself statement.

Both ways will work.

Hi,

I will try this option too. Thanks for your update.

Cheers