Access server through it's public IP from behind SA520 1

[fs483]

Hello,

I went to replace a Linksys router with a SA520W for a customer. When testing their applications, I discovered one of their inhouse developped application uses the servers public IP address instead of a hostname or internal IP. The linksys router didn't seem to mind that an application from behind the Linksys would attempt a connection to the public IP of the server. I know the PIX series forbid this kind of behavior and I guess the ASA and the SA probably has the same limitation. Now, there's no way to change the hard coded IP in the application. What can I do to bypass this restriction? If the hardcoded IP was a hostname, then I would simply create a host record in the Windows Server DNS and redirect it to an internal IP but that's not the case. I tried using the host files on the workstations but it only allows hostname to IP also. Any ideas?


Thanks
fs483

 

[ISPKing]

You Don't happen to be in Louisiana do you>?

CCNP

 

[ISPKing]

oops i meant are you***
long day....

CCNP

 

[fs483]

Nope.

 

[unclerico]

try destination nat:

static (outside,inside) <public_ip> <private_ip> netmask 255.255.255.255

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[fs483]

No CLI in SA.

 

[North323]

try creating a new zone and create rules specific for this application. does it use https?

 

[ISPKing]

The SA is a revamped Linksys.

CCNP

 

[fs483]

Please explain creating a new zone? Are you referring to accessing the GUI of the SA through HTTPS?

 

[North323]

yes i am. there is a tab for zones.

 

[fs483]

I finally solved the problem. I managed to find a copy of the application that didn't have the IP hardcoded. Everything works fine now.

I was planning on ordering another one of these SA520W for another customer but I think I'm going to stick with an ASA5505. I know CLI is a bit hard to understand but I've always configured Pix and ASA using CLI. The only thing I like of GUI is being able to view the logs and usage statistics in real time. Things never seem to go well when using the wizards for me.

Thanks,

 

[North323]

way to stick with it!

 

[fs483]

I'm still curious about the Zones and will give it a try. The executable on the laptops for the rep outside the office still have the public IP hard coded which works fine when they are outside the network. However, when they come into the office, then they might encounter the same problem. Having the zones properly setup avoids that problem.

Thanks,
fs483