Solved

Port forwarding on Cisco ASA

Posted on 2009-05-08
5
465 Views
Last Modified: 2012-06-21
I'm trying to setup a port forward through an ASA firewall for a webserver. I used the guide posed here and now i can access the web server externally just fine using the external URL.
however the problem i'm having is that internal machines are not able to access the web server using the external URL.
I'm not quite sure why this is or how i can go about fixing it.

I have attached the configuration file i'm using.

Thanks
asa.txt
0
Comment
Question by:curwengroup
5 Comments
 
LVL 43

Expert Comment

by:JFrederick29
Comment Utility
Where is DNS resolution handled for the website hostname?  If external, you can use DNS rewrite.  Connect to the website by DNS name (not IP).

conf t
static (inside,outside) tcp interface www Web_Server www netmask 255.255.255.255 dns
0
 
LVL 11

Accepted Solution

by:
sysreq2000 earned 500 total points
Comment Utility
If you have your own DNS server then the easiest way is to create DNS entries for that URL pointing to the internal IP. Then your internal clients will connect directly without going out through NAT first.

If you don't have a DNS server then you can try hosts entries. Otherwise what you're trying to do is known as hairpinning. Google cisco and hairpinning and you will find some discussions on the topic. Officially it can't be done but there are workarounds.
0
 

Author Comment

by:curwengroup
Comment Utility
The DNS resolution is handled by en external DNS server for this domain.

I tried the DNS doctoring as described by the Cisco article
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml

unfortunately it's not working for some reason, i suspect it's because i'm using an internal DNS server that forwards to other external DNS servers so the ASA does not get a chance to return the proper doctored DNS reply.

I will run a packet capture to confirm or deny.
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Your internal dns server is going to cache the records and never send the request through the ASA
0
 

Author Comment

by:curwengroup
Comment Utility
Good point on that.
I also tried setting one of my workstation with my ISP's DNS server to test it out and it did not work.
However i tried hairpinning and that seems to work just fine.

Thanks
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now