Cisco ASA Hairpin Internal Server

Hello Po

Remember that NAT translations are bidirectional. Even though the output of the show xlate command shows INSIDE first and then OUTSIDE, this translation also indicates that the reverse is true.

The ASA handles the reverse direction implicitly. When traffic comes from the outside (Internet) to the web server, the ASA translates the destination IP from 192.168.2.220 to 192.168.1.2, and when the server responds, it translates the source IP from 192.168.1.2 to 192.168.2.220.

In other words, the ASA consolidates the NAT translation into a single entry for clarity and simplicity. The translation entry shown by show xlate covers both the outbound and inbound translations due to the nature of static NAT, making it unnecessary to display separate entries for each direction. The ASA ensures that both directions are handled appropriately, even though the output may appear to only reflect one direction explicitly.
Does that make sense?

I hope this has been helpful!

Laz