paolo.....thank you for the reply.....In this case the public IP will not have an internal address for it. They (the 150.x.x.x range) will not be NAT and will need to be accessed from the outside world, thru our internal network annd accross the frame to this router in which the server resides

I hope I am making sense in explaining this...

The static routes are indeed ugly, but due to some organization policies between us and the customer, a dynamic protocol can't be used in this case.

Hi, you explained the issue very well.

The config command I gave you, does what you're asking for. You pick a public address and assign to an internal one, only for tcp port 80 in the example above. This has nothing to do with the NAT you guys are using to browse the Internet.

Now here's the gotcha that I forgot to mention before. Since the other site also has an independent internet access, you cannot let the reply packets to accesses from outside, to go thru that connection, because that would break the TCP.

So you need a special config called "PBR". that is policy based routing, on THEIR router, that is the one the other side of the frame relay. it goes like:

interface fastethernet x/y <-- the LAN IF facing server

ip policy route-map servers

access-list 111 permit tcp I.I.I.I 255.255.255.255 eq www any

!

route-map servers permit 10

match ip address 111

set ip next-hop 172.16.203.246

See also:

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009481d.shtml

Sorry, there is no easier way than that. In other words, it's magic to tell that packets going to the internet in response to an access, should transit "YOUR" connection and not "THEIR".

If you can't quite grab the concept at first, don;t worry, there's people with 5 years experience that doesn't :)

Let us know and remember to rate useful posts!

Got a second thought. Actually thre's is an alternative in case they really really do not want to use the PBC commands give above.

That would be making a superspecial NAT so the server sees all requests as coming from one of your LAN addresses, but it's much more complicated either conceptually and practically.

So I hope you will be happy with my first suggestion above.

Paolo,

So with PBR the basic principle is to redirect the traffic sourced from 10.0.0./8 that say originally was set to flow through Interface ser0/0 because of route metric decisions say for simplicity RIP has one hop over serial0/0 and two hops over ser0/1.

But you have a route map specified for PBR

like this

route-map net-10 permit 10

match ip address 111

set interface serial0/1

traffic will now flow out serial0/1 interface

match ip address 111

access list 111 permit ip 10.0.0.0 255.0.0.0

Never mind I get it now. Thanks

Excellent information.....it will be awhile before we can test this, but looking over some documents PBR should accomplish what we are trying to do. I will advise the discussion when we see what happens

Hi,

If you will go testing that, remember that depending from were they also access the server I.I.I.I, ACL 111 may need further tuning.

Again, the idea is that only traffic going to the internet as replies to access, will take the special path.

Thanks for the appreciation and good luck!