思科ASA防火墙端口NAT回流

参考 1.CISCO ASA Hairpinning NAT配置 2.Cisco ASA Hairpinning技术解决内网通过公网IP访问内网服务器问题 3.CISCO ASA HAIRPINNING解决公网内网使用问题IP访问内部服务器 4.ASA5510 8.2 关于内网回流！

使用Cisco的Hairpinning技术

IOS 8.3以后版本的 Hairpinning技术相关配置如下：

1.公网端口映射 内网10.24.11.216:80-->8.8.8.8:10080

object network server01   host 10.24.11.216   nat (inside,outside) static 8.8.8.8 service tcp 80 10080 //定义Object access-list OUTSIDE_access_in extended permit tcp any host 10.24.11.216 eq 80 access-group OUTSIDE_access_in in interface outside //放行ACL

2.内网通过公网地址直接访问 内网访问8.8.8.8:10080-->10.24.11.216:80

same-security-traffic permit intra-interface //允许同一接口启动进出口流量  object network INSIDE-INSIDE-hairpinning-NETWORK   subnet 10.24.0.0 255.255.0.0   nat (inside,inside) dynamic interface //定义内网网段inside->inside方向   object network MES216-Hairpinning   host 10.24.11.216 (服务器IP)   nat (inside,inside) static 8.8.8.8 service tcp 80 10080 ///定义内网到内网映射  access-list OUTSIDE_access_in extended permit tcp any host 8.8.8.8 eq 10080 access-group OUTSIDE_access_in in interface outside 放行ACL流量-非必要操作

如果第一步过映射，则公网端口映射此步不能做。