Need Help on one Firewall Question

Question

Hi All,
I am using cisco asa in my environment and which is connected to l2. One server and one router is also connected to L2. Now i want to access port 80 on my server from outside.
How its possible if the server gateway is routers ip and i don't want to add static route in router or server towards the firewall. Nat and access List is done on firewall. what else i can do on firewall to access port 80 of my server from outside. Dont want to change anything on router/server.
Below is the IP detail
1. Firewall inside 192.168.1.1 & Outside 1.1.1.1
2. Router IP - 192.168.1.2
3. Server IP - 192.168.1.3 & GW - 192.168.1.2

Answer 1

Hi,
Well the only ways I could think that the connections could be gotten working would be
Policy Based Routing on the Router that would forward the web servers traffic through the firewall instead of the routers default gateway (even just the return traffic for web connections)
Configuring NAT on the ASA firewall so that all traffic from the Internet would be NATed to an internal IP address from the network 192.168.1.0/24. This would mean that the server would be sending the traffic to ASA instead of using its default gateway. And this is ofcourse because the server would be seeing all connections coming from its connected network and wouldnt have to use the default gateway.
You havent mentioned what type of NAT you are doing on the ASA for the server Static PAT or Static NAT. Static PAT would be forwarding a single (or several ports) only while Static NAT would be dedicating a single public IP address for the server.
I would imagine that you would have to configure 2 separate NAT statements
Dynamic Policy PAT for the External hosts
This should NAT all traffic coming from the Internet to the IP address of your ASAs "inside" interface WHEN the destination is the public IP address of your Web server.
access-list POLICY-NAT-WEBSERVER remark NAT inbound web traffic to an internal IP address
access-list POLICY-NAT-WEBSERVER permit tcp any host 1.1.1.1 eq 80
nat (outside) 100 access-list POLICY-NAT-WEBSERVER
global (inside) 100 interface
Static NAT or Static PAT for Web server
Either of these NAT configurations should forward the connections to your Web servers public IP address on port TCP/80 to the Web server.
Together with the above NAT configuration the return traffic from the Web server should flow back through the ASA.
static (inside,outside) 1.1.1.1 192.168.1.3 netmask 255.255.255.255
or
static (inside,outside) tcp 1.1.1.1 80 192.168.1.3 80 netmask 255.255.255.255
If you are using the public IP address on the ASA "outside" interface then replace the 1.1.1.1 with "interface". The IP address 1.1.1.1 stands for a public IP address that you might use.
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni