01-12-2009 05:31 PM - edited 03-11-2019 07:36 AM
Hi All,
i am trying to prepare for exam and i'm bit stuck with this scenario in my lab. Could someone help me with this? I'm trying to nat one outside global ip address and tcp port to two different inside server based on source ip address.
I have two user pools 10.18.1.0/24 and 10.18.2.0/24 and all users are set to use proxy server 172.16.1.1:8080. That proxy sever was nated on FWSM to 192.168.1.1, but now i want to split the load and want to nat one user subnet (10.18.1.0/24) to 192.168.1.1 and second user subnet to 192.168.1.2.
What i did is i've configured two access-list's
ACL1:
access-list permit tcp host 192.168.1.1 eq 8080 10.18.1.0 255.255.255.0 eq 8080
ACL2:
access-list permit tcp host 192.168.1.2 eq 8080 10.18.2.0 255.255.255.0 eq 8080
i can apply one static:
static (inside,outside) tcp 172.16.1.1 8080 access-list ACL1
fwsm accepts this command but when i try to apply second static:
static (inside,outside) tcp 172.16.1.1 8080 access-list ALC2
i'm getting error that global already used.
What am i doing wrong here?
Thanks
01-15-2009 11:15 AM
You can try these configs
Assuming that the src traffic is 10.18.1.0 dst is 172.16.1.1:8080
access-list Policy10 x.x.x.x y.y.y.y where x.x.x.x is the src/subnet and y.y.y.y is the dest
static (inside,outside) 192.168.1.1 access-list Policy10
access-list Policy20 x.x.x.x y.y.y.y where x.x.x.x= src of traffic and y.y.y.y dest of trafic
static (insode,outside) 192.168.1.2 access-list Policy20
This means that xlate when the access-list triggers (src,dst) of traffic
01-19-2009 08:43 AM
Thanks i will try that
01-19-2009 09:24 PM
Did this work for you, just checking...
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide