To make it simple : we have an 8 IPs subnet bound to one of our external interface. We’re doing dynaminc NAT with one of these addresses to get out. We are also statically NATing our servers to the other IPs (quite usual I think). From now on we’ve been using split DNS to access servers from inside and outside.
Now we want to access our severs with their external IPs from inside network and haven’t been able to configure it on the PIX.(see the screen of network)
I use the command : same−security−traffic permit intra−interface
Now when I try to connect to a web server from an IP in 10.0.0.0 here is my log on PIX:
6 Nov 23 2009 18:10:20 305011 10.0.0.6 *.*.*.209 Built dynamic TCP translation from inside:10.0.0.6/1353 to FibreOptique:*.*.*.209/19164
6 Nov 23 2009 18:10:20 302013 *.*.*.211 10.0.0.6 Built outbound TCP connection 565861 for FibreOptique:*.*.*.211/80 (*.*.*./80) to inside:10.0.0.6/1353 (*.*.*.209/19164)
6 Nov 23 2009 18:10:38 302014 *.*.*.211 10.0.0.6 Teardown TCP connection 565861 for FibreOptique:*.*.*.211/80 to inside:10.0.0.6/1353 duration 0:00:30 bytes 0 SYN Timeout
I don't understand why I can't connect to this webserver and why there's a TEARDOWN TCP.
So what you are trying to do is hairpin traffic on the outside interface. That is not supported automatically on the ASA.
Usually accessing an outside ip from the inside is not recommended. An internal dns servers need to be tweaked to give internal ip addresss (something you have done I think with split dns). Also if you are using outside dns servers you can do dns doctoring so that internal hosts will use internal ip addresses to go to.
Now you might be able to get away with it, but it will not be the recommended solution.
You need the "same security intra", which you already have.
The latter static is to have the ASA take the return traffic for the client. If the server and the client are in the same subnet then the server might respond to the client directly (not through the ASA) which would cause assymmetric routing. You need the ASA to hairpin and back and forth traffic.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :