Q:

How Do I Access A PIX External Port-Forward From The Inside Network?

I have a PIX running 8.0(3).
I've got a port-forward to permit external users to hit a server on my inside network set up as so:
static (inside,outside) tcp interface 8080 192.168.168.100 8080 netmask 255.255.255.255
access-list ACLIN extended permit tcp any host xx.xx.xx.135 eq 8080

...and this works for external users.  But people on the inside network can't hit http://xx.xx.xx.135:8080, what ACL do I have to add to permit this?

A:

To access an inside host from an externally facing NAT IP address adds a number of issues.
First, the PIX/ASA has to be configured to allow this type of communication.  Generally it does not by default.
Second, it can lead to a number of asymmetrical routing issues. For instance, NAT traversal does not change the source IP address on an incoming packet.  So what can happen is that H1 (internal host) makes request to ES1 (external server IP/port).  On the firewall, NAT changes the destination from ES1 to IS1 (internal server IP/port) and forwards the traffic.  IS1 processes the request, sees that H1 is on the local network and forwards it there.  H1 rejects the connection because it established a connection to ES1 and expecting traffic from ES1 on that port, not IS1.
Do a web search for "Cisco ASA hairpin" and you should find a number of discussions about working around these issues on the Cisco site, plus a large number of non-Cisco related references.  For instance:
https://supportforums.cisco.com/thread/1003238

