Cisco ASA One Public IP to Many Private IP Translation

Unanswered Question
Nov 28th, 2008


Has anyone come across a solution where a customer is trying to map 1 public IP to many internal private IP's?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Jon Marshall Fri, 11/28/2008 - 14:41


This is called port forwarding and is quite common. The main restriction is you need to be using different ports so

static (inside,outside) tcp 25 25 netmask

static (inside,outside) tcp 80 80 netmask

is a perfectly valid configuration where any traffic received on the outside interface of your firewall going to destination port 25 will be sent to port 25 destination port 80 will be sent to port 80

but what you can't do is

static (inside,outside) tcp 25 25 netmask

static (inside,outside) tcp 25 25 netmask

where you map the same public IP address and port number to 2 different private IP addresses.


marlon-chung Fri, 11/28/2008 - 14:49


Thanks for the quick reply. In this case its web services with SSL certificate, so TCP port 443 is what I would be using for port forwarding, but it wont work as I know you can't map the same public IP to more than 1 private IP using the same port number.

cisco24x7 Fri, 11/28/2008 - 15:55

solution is a very simple one. You can:

1- get more than 1 static IP addresses

2- put a load balancer such as F5 BigIP so

that the External users only see 1 public

IP but it is load-balance by the BigIP to

multiple servers internally,

3- get a ISA server for reverse-proxy,

Either way, you can not map the same public

IP to more than a private IP on the same


You can get 5 static IPs from Verizon for

like $20/month.

marlon-chung Fri, 11/28/2008 - 16:00

Thanks for the quick reply.

Option 1 and 2 is no go, however, option number 3 looks interesting. I will look into option 3 further.



This Discussion