The Problem:

I recently had a situation where hosts on my internal LAN needed to communicate with a servers on our DMZ using its public IP address instead of its private address.

In my case this was causing issues with one way communication on out Mitel Teleworker / Mitel Border Gateway solution. When phoning an internal phone from a Mitel phone on the Internal the conversation was one way.

i found after some packet tracing this was because when the phone on the internal network sent its traffic, it was sending it to the public IP address of the Mitel Teleworker Mitel Border Gateway server in the DMZ rather than the servers private DMZ address.

The packets where being sent to the outside world and where being lost.

My Configuration:

I am using a Cisco ASA with three active interfaces one is connected to the internal LAN (Core), one is connected to our DMZ and the final is connect to the outside world

Solution ASA with a version above 8.3

If you are a version higher than 7.0 then use “Outside Nat”

This nats clients on the inside interface accessing the server using its public IP to the server private IP

ASDM:

outsideNat_new.PNG

Solution: ASA with version below 8.3

If you are a version higher than 7.0 then use “Outside Nat”

This nats clients on the inside interface accessing the server using its public IP to the server private IP

Console:

1) Enter global config mode on the ASA
2) Enter the command

STATIC (dmz,inside) xx.xx.xx.xx ii.ii.ii.ii netmask 255.255.255.255

Where;

xx.xx.xx.xx       is the PUBLIC address

ii.ii.ii.ii       is the internal address on the DMZ

ASDM:

If you prefer to use ASDM then create a static NAT rule on your DMZ interface that looks like the below

OutsideNAt.JPG

 

Solution: PIX  with a version earlier than version 7.0

If you are using PIX earlier than version 7.0 then use the ALIAS command to perform dnat

Console:

1) Enter global config mode on the PIX
2) Enter the command

ALIAS (inside) xx.xx.xx.xx ii.ii.ii.ii 255.255.255.255

Where;

xx.xx.xx.xx       is the EXTERNAL address

ii.ii.ii.ii       is the address on the DMZ

After version 7.0 the ALIAS command was depreciated – while it still works OK in Version 7.0, Cisco ASDM doesn`t support the ALIAS command in new versions.