[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 250
  • Last Modified:

ASA 5505: access from Single Machine in DMZ to all internal machines on a specific port

WE have a pix on a stub network. We have 2 DMZs on it and want to allow a PC which is on it's own in one of the DMZ's and needs to contact the PC's on the internal network . Is it possible to do dynamic nat from outside to inside?  Can I have an example based on below.

ASA 5505

DMZ1 , Sec level 50 Int Address 192.168.2.1 /24    PC address 192.168.2.100
Inside,  Sec level 100 Int Address 172.16.2.1 /16    PC address Range 172.16.2.10 - 20

Thanks
0
bentham1
Asked:
bentham1
  • 2
1 Solution
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
Would you really need NAT at all? Yes, NAT should work, but have you tried setting up an NAT excemption? If the ASA is the Default Gateway for both the DMZ and the inside network, nothing else should be necessary ... (or, you could configure the "allow traffic through firewall without NAT" option, then all you need is the access list entry)
0
 
bentham1Author Commented:
For some reason, NAT is a requirement. Can't make that out myself - but I am too far down the pecking order!!
0
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
OK, using ASDM, just go to the NAT rules and add a new static policy rule with Original Interface as the DMZ interface you have the PC in, source the PCs IP, destination 172.16.2.0/27 (covers .1-.31), translated interface the internal interface, "Use IP address" some internal IP (don't use the interface IP address or you won't be able to connect to the FW anymore through it), then possibly add port translation if you want to limit it (or add them as access rules). That should do the trick.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now