Cisco ASA hairpin for guest network

I just replaced a Netscreen firewall with an ASA 5515-X.  Everything works, almost!  The Netscreen allowed clients on the guest network to access NATed hosts on the DMZ and inside interfaces, with their Internet addresses. There was nothing special about, it just worked. I think on the ASA I need to setup a hairpin or U-turn to make this work.  I have looked around and not sure I understand it, so I'm asking here.
 
Here's my config.  No vlans on the ASA just individual interfaces.
 
outside  #.#.#.#/28              From ISP
inside   10.0.0.0/8                internal DNS
guest    192.168.1.0/24        external DNS
dmz      192.168.2.0/24        exteranl DNS
 
What I would like is for any client on the guest network to act as if it was any client on the Internet.  Is this doable? If so what's the best way to do it?
 
Thanks...Jim
JimNowotnyAsked:
Who is Participating?
 
JimNowotnyAuthor Commented:
I've done I lot of looking around and it seems doing what I want to do is not recommended by Cisco.  Seems crazy to me.  So I'm just going to use a different firewall all together for the guest network.

This question can be marked closed.
0
 
JimNowotnyAuthor Commented:
This is version 9.1
0
 
QuoriCommented:
This is possible and is source NAT, but it'll appear to come from the IP address of the ASA interface, and you'll lose a lot of information useful to auditing. Is this really what you want? Its not great from a security point of view.

If so, are the interfaces (DMZ and Guest) the same security level?
0
Turn Raw Data into a Real Career

There’s a growing demand for qualified analysts who can make sense of Big Data. With an MS in Data Analytics, you can become the data mining, management, mapping, and munging expert that today’s leading corporations desperately need.

 
JimNowotnyAuthor Commented:
They are not, but can be. Right now the the DMZ is 50 and Guest is 25.
0
 
Jan SpringerCommented:
A couple of things:

1) Don't change the security level, they're different for good reason
2) Do nat exemption between the guest and dmz networks
3) Create an access-list for guest network (in) allowing traffic to the dmz for only those services to specific IPs that need to be reached by guests.
0
 
JimNowotnyAuthor Commented:
No good answer
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.