How to configure Hairpin NAT for Cisco Expressway

[Alex_Alborzfard]

I've been tasked with configuring our gateways to support Cisco Expressway architecture with Hairpin/Reflected NAT?

I followed sk110019, but it doesn't have all the information I'm looking for. Has anybody have done this before that I can pick their brain?

[funkylicious]

Are you trying to access a public IP/resource which is NATed to an actually resource on your LAN/DMZ ?

[Alex_Alborzfard]

An external client needs to access Cisco Expressway-E server on few ports, only on the public side of it and the rest of the traffic to the private side. I've attached couple of diagrams to help visualize the architecture and traffic.

[PhoneBoy]

Probably something like the answer I gave here: https://community.checkpoint.com/t5/Security-Gateways/Traffic-flow-in-between-C-to-S-via-Firewall-Ho...

[Alex_Alborzfard]

Thanks, but TBH it's not a lot more helpful than the sk. I'm looking specifically for someone who has configured CP gateways to support the Cisco Expressway solution. I must be the only one! 😊

[PhoneBoy]

From the diagrams you’ve attached, which should have been done inline instead, it seems like Cisco Expressway might do some application aware stuff.
In which case, simple NAT rules may not work.
It also tells us nothing about your specific environment or what precisely you expect the gateway to do.

Regardless, it would help to know precisely what you configured, what didn’t work, and what troubleshooting steps (with precise results) you did.