Cisco Support Community
Community Member

Packet Redirection and NAT order of Operations (ASA)



I know that cisco ASA wont allow packet redirection on same interface i.e. lets assume that i have a web server sitting internally with ip address There is static nat entry defined in ASA so that public ip address gets translated to External clients can reach the web server but internally if someone on subnet 192.168.1.x tries to go reach the webserver (by FQDN name) it will fail (because of packet redirection on same interface). I have the following cisco link explaining cisco ASA order of operations

My question is when packet  arrive at the inside interface, what will cause it to be dropped i.e. ACL, policy routing, routing etc etc (from section NAT overview Inside-to-Outside in first link above)


Super Bronze

Packet Redirection and NAT order of Operations (ASA)


A host connecting from behind an interface to an IP address that is configured on another interface (or in your case configured as a NAT IP address) is simply not allowed by the ASA.

The first document you linked seems to me have to do with Cisco Routers and doesnt apply to ASA firewalls.

Incase you are using the external DNS server then you can add a "dns" parameter to your Web servers Static NAT configuration.

Software 8.2 and below

static (inside,outside) netmask dns

Software 8.3 and above

object network STATIC


nat (inside,outside) static dns

In both of the above cases the ASA uses the "dns" parameter. What the "dns" parameter does is look for DNS query and reply messages and determine if an DNS reply from a external DNS server contains some NAT IP address configured for a host behind the ASA (like above examples)

If the DNS reply shows a public IP address that matches some Static NAT configuration then the ASA will modify the DNS reply to point to the local IP address and the host will connect to that instead of the public IP address.

If you are using Internal DNS server (which means ASA wont possibly see the DNS messages) or you just want to keep connecting to the public IP address then you have to also configure NAT configurations which enables your users to connect to the public IP address from your internal network.

To give you an example would really need to know your setup better and the software level you are using.

- Jouni

Hall of Fame Super Silver

Packet Redirection and NAT order of Operations (ASA)


Also recall that we must enable DNS inspect in the global (or interface) service-policy for the DNS rewrite to work.


In addition to heeding Jouni's good suggestion, you can always check the validity of a flow through an ASA using the packet-tracer command. It will walk you through all the logic steps and tell you if the packet will pass or, if denied, where if stops. More info is here:

..and of course in the command reference.

Super Bronze

Packet Redirection and NAT order of Operations (ASA)


Most of the time that is enabled but can naturally be in this case that it isnt, but I was really waiting for more specific follow up information from the poster before writing more.

There are so many occasions where I might take a long time to reply someone only to find that the original poster never replies.

- Jouni

Hall of Fame Super Silver

Packet Redirection and NAT order of Operations (ASA)

Very true, Jouni. This is quite often the case when the OP only has a small handful of posts.

I was just reminded of it since I am studying for my CCNP firewall test and that detail was in a practice question.


- Marvin

CreatePlease to create content