Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA 5510 Guest Wireless Needs To Access Internal Web server

I have set up guest wireless with our ASA 5510 and WLC 2504 as follows:

Port 2 of the 2504 is connected to interface Ethernet0/2.62 on the 5510.

The guest wireless SSID is mapped to a dynamic interface using port 2 of the 2504.

I have a dynamic NAT rule on the 5510 allowing any traffic from the guest wireless interface (Ethernet0/2.62) to the outside.

I have a DHCP pool on the 2504 that is configured for external DNS (

Wireless clients can access the internet successfully and cannot access our internal network (as desired).

I have one problem: I need guest wireless users to be able to access our internal web server. I have done some research and found a few posts recommending DNS rewrite as the fix.

I have enabled DNS rewrite on the static NAT rule for our internal web server but guest wireless clients still cannot access the internal web server.

Any input as to a resolution would be greatly appreciated...

Thank you

Everyone's tags (2)
Super Bronze

ASA 5510 Guest Wireless Needs To Access Internal Web server


If the Guest network hosts DNS queries are still answered with the public IP address of your Web server then I would suggest configure Static NAT or Static PAT (Port Forward) from your "inside" to "guest" for the Web server the same way you have for the "inside" to "outside" direction.

Naturally the configuration format depends on your ASA software

If you wanted to configure Static NAT the configurations would be the following

Software 8.2 or below

static (inside,guest) netmask

Software 8.3 or above

object network WEB-SERVER


nat (inside,guest) static

Hope this helps

- Jouni

CreatePlease to create content