Unleashing External Access to Web Servers with Cisco ASA: A Step-by-Step Guide to Site-to-Site VPNs and Static NAT

8 August 2024

Understanding the Challenge

When it comes to securing web servers behind a Cisco Adaptive Security Appliance (ASA), configuring external access can be a complex task. The challenge lies in establishing a secure connection between the outside world and the internal web servers, while ensuring that only authorized traffic is allowed through. In this article, we will focus on using Site-to-Site VPNs and Static NAT to achieve external access to web servers configured behind a Cisco ASA.

Prerequisites

Before we dive into the configuration steps, it’s essential to have the following prerequisites in place:

A Cisco ASA device (preferably version 9.5 or later) with at least one interface connected to the outside network and another connected to the internal network.
Two web servers running a web server application like Apache or IIS behind the internal network of your ASA.
A Site-to-Site VPN setup between the Cisco ASA device and the external network.

Step 1: Configure the Site-to-Site VPN

To establish a secure connection to the external network, you’ll need to configure a Site-to-Site VPN on your Cisco ASA. This involves generating and exchanging public keys with the external VPN peer, configuring the tunnel properties, and enabling NAT traversal if necessary.

# Step 1: Configure the Site-to-Site VPN
## Generate Public Keys for Each Peer
    On both devices, run:
    ```
    crypto key generate rsa general-keys modulus 2048 exportable no subject-key-id ip-source-dns address-pool none usage-security-level 3
    ```
## Configure IPSec Tunnel Properties
    Configure the tunnel on your Cisco ASA using commands similar to these:
    ```cisco
    crypto ikev2 policy <policy-name>
    set trust-point <trust-point-name>
    ```
    `crypto ipsec transform-set <transform-set-name> esp-aes-256 esp-sha-hmac`
    `match identity interface outside`
## Configure the IPSec VPN Tunnel
    Use commands like these to configure the IPSEC tunnel:
    ```cisco
    crypto ikev2 keyring <keyring-name>
    match identity local address-pool <pool-name>
    ```
    `crypto ipsec profile <profile-name>`
    `set pfs 2048`
## Enable NAT Traversal if Necessary
    If your Cisco ASA device is behind a NAT or firewall, you may need to enable NAT traversal on the VPN peer.

Step 2: Configure Static NAT for External Access

Now that the Site-to-Site VPN is set up, it’s time to configure Static NAT on your Cisco ASA. This will allow external traffic to reach your internal web servers.

# Step 2: Configure Static NAT for External Access
## Identify Web Servers and Their External IP Addresses
    Note down the external IP addresses of your web servers. These will be used in the Static NAT configuration.
## Configure Static NAT on Your Cisco ASA
    Use commands like these to configure Static NAT:
    ```cisco
    static (inside,outside) <outside-ip> <web-server-internal-ip>
    ```
    `timeout 3600`

Conclusion

With Site-to-Site VPNs and Static NAT configured on your Cisco ASA, you can now allow external access to web servers running behind the appliance. This setup provides a secure connection between the outside world and your internal web servers while ensuring that only authorized traffic is allowed through.
This configuration is particularly useful for organizations with remote teams or customers who need to access web applications hosted internally. By following these steps, you can ensure a seamless and secure experience for external users while maintaining control over internal network resources.

Poespas Blog