cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
511
Views
0
Helpful
7
Replies

one DMZ interface with 3 different Server having different listening ports

Navaz Wattoo
Level 1
Level 1

i have one DMZ interface with 3 different Server having different listening ports in cisco asa 5510

Navaz
1 Accepted Solution

Accepted Solutions

 

Yes , you can do it on version 8.2 using Static inside PAT. When we want to allow inbound connectivity to a no. of local servers, using a single global IP address. Remember, of course, that an interface access-list on ASA would still need to be configured to allow such connections. It allows port redirection so that multiple local servers, using unique local ports, can share a single global IP address.

static(DMZ,outside) tcp 125.209.70.90 6080 10.1.1.245 6080 netmask 255.255.255.255

static(DMZ,outside) tcp 125.209.70.90 443 10.1.1.246 443 netmask 255.255.255.255

static(DMZ,outside) tcp 125.209.70.90 80 10.1.1.254 80 netmask 255.255.255.255

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 6080

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 443

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 80

HTH

 

"Please rate helpful posts"

View solution in original post

7 Replies 7

Poonam Garg
Level 3
Level 3

what exactly you are trying to achieve

Dear

i have one cisco 5510 asa and having one inside and one outside interface and one dmz interface.

inside ip:192.168.11.249

outside ip: 125.209.70.90/29

dmz ip: 10.1.1.1/24

in dmz zone i have three servers having ip belo

server1 ip : 10.1.1.245  with listeing port 6080

server2 ip : 10.1.1.246 with listining port 443

server3 ip : 10.1.1.254 with listening port 80 

 

and i want to traslate these ip into outside interface

and want to open these from outside over ther intenet like

125.209.70.90:6080/abc

125.209.70.90:443/xyz

125.209.70.90:80/asd

 

Thanks 

 

Navaz

What version?

 

Try to post as much information as possible on each answer u provide.

 

Regards

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

version 8.2

Navaz

 

Yes , you can do it on version 8.2 using Static inside PAT. When we want to allow inbound connectivity to a no. of local servers, using a single global IP address. Remember, of course, that an interface access-list on ASA would still need to be configured to allow such connections. It allows port redirection so that multiple local servers, using unique local ports, can share a single global IP address.

static(DMZ,outside) tcp 125.209.70.90 6080 10.1.1.245 6080 netmask 255.255.255.255

static(DMZ,outside) tcp 125.209.70.90 443 10.1.1.246 443 netmask 255.255.255.255

static(DMZ,outside) tcp 125.209.70.90 80 10.1.1.254 80 netmask 255.255.255.255

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 6080

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 443

access-list OUT_DMZ permit tcp any host 125.209.70.90 eq 80

HTH

 

"Please rate helpful posts"

Thanks a lot ponam can u send also the bat configuration

and outside the internet 125.209.70.90:8888/dhamap its not working

Navaz

i need to open these below

local server haiving ip 10.1.1.245 with 8888 port at 125.209.70.90:8888/abc 

local server haiving ip 10.1.1.246 with 443 port at 125.209.70.90:443/xyz 

local server haiving ip 10.1.1.254 with 80 port at 125.209.70.90:80/asd

 

Over the internet in 8.2 cisco asa 5510

 

Navaz
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card