Hello Scott,
It seems that your situation is like this --
- 1 public IP address (assinged to outside interface of PIX.)
- 5 web-servers (may be more), on the interfanal network, you need to access these servers from outside using public IP address assigned to outside interface of PIX.
- 2 FTP servers which are also on inside network and are to be accessed from outside using public IP on outside interface of PIX.
** No. of internal servers fictitious.
Problem in this scenario is that we need to map a single public IP to many internal IPs. This would have been ok if internal servers wer using different services, but when it comes to 5 webservers which need to use the same IP, or 2 FTP servers which need to use same public IP, it is a problem. Why?
In such scenarios, we generally do port-redirection. But this works when there are internal servers, working on independent ports. For eg. 1 web-server, 1 mail server, 1 ftp server. Here we can redirect port 80 traffic from public IP to web server, port 25 to mail server and port 21 to FTP server.
Problem is that there are multiple internal web servers, which are all working at port 80 !! And we can redirect port 80 from the public IP to only one of these servers !! Solution?
Well .. though there is not a very clear solution, we need to have things modified at the clients end. What we need to have clients on outside do is, have them send requests for webserver1 on port 80, request for webserver2 on port 8080, request for webserver3 on port 8081. How this helps?
- we redirect port 80 from outside public IP to webserver1 internal IP on port 80
- redirect port 8080 from outside public IP to webserver2 internal IP on port 80
- redirect port 8081 from outside public IP to webserver3 internal IP on port 80
I understand that this may not seem to be a very good solution, but with current limitations, this is the only option available .. :(
Let me know if you need commands for this. Hope this is helpful.
Regards,
Vibhor.
