Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Hairpin from inside to public ip nat to DMZ

Hello I have an ASA5510 which I am trying to move into production.

Currently I have external, internal, and DMZ interfaces. I have a proxy setup for the inside traffic to get out. I also have a static nat for a DNS server in the DMZ zone. I would like to have the users on the inside interface get to outside public ip of the DNS server not the private one.

inside is 172.16.3.0/24

dmz is 172.16.2.0/24

outside is 208.xxx.xxx.xxx/24

static (dmz,outside) 208.xxx.xxx.xxx 172.16.1.x netmask 255.255.255.255

3 REPLIES

Re: Hairpin from inside to public ip nat to DMZ

You want to configure Bi-Directional NAT. Here's an excellent article on how to do that.

http://blogs.interfacett.com/mike-storm/2006/6/29/bidirectional-nat-on-a-cisco-pix-or-asa.html

Hope it helps.

Cisco Employee

Re: Hairpin from inside to public ip nat to DMZ

From what you are describing it seems you want the inside user to use the 208.xxx for the dns. The you will just need

static (dmz,inside) 208.xxx.xxx.xxx 172.16.1.x netmask 255.255.255.255

And of course to open the inside to not drop traffic to the 208.xxx.xxx.xxx

I hope it helps.

PK

Re: Hairpin from inside to public ip nat to DMZ

neither of those nat's worked. I still am unable to see the outside address

1289
Views
0
Helpful
3
Replies
CreatePlease to create content