Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX Port Forward with Two IP Address

I have to static IP address from my ISP.  I am going to be hosting two web servers, one per IP address.  How do I get the PIX to route each external IP to the correct web server?

I currently have one setup and works just fine, but I am trying to figure out how to get the second one to work. Can I use port 80 for both or will I need to change that as well.

Below is my current config:

External IP Address  ---> Currently hosting and working fine  ---> Future Web Site

Web Servers  ----> Working web server ---> Furture web server

PIX Version 8.0(4)32


hostname pixfirewall


enable password DQucN59Njn0OjpJL encrypted

passwd DQucN59Njn0OjpJL encrypted

no names


interface Ethernet0

nameif outside

security-level 0

ip address


interface Ethernet1

nameif inside

security-level 100

ip address


interface Ethernet2


nameif exchange

security-level 100

ip address


ftp mode passive

dns domain-lookup inside

dns server-group DefaultDNS




access-list ouside-acl extended permit tcp any host eq smtp

access-list ouside-acl extended permit tcp any host eq www

access-list ouside-acl extended permit tcp any host eq https

pager lines 24

mtu outside 1500

mtu inside 1500

mtu exchange 1500

icmp unreachable rate-limit 1 burst-size 1

icmp deny any outside

asdm image flash:/asdm-602.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1

static (inside,outside) tcp interface smtp smtp netmask

static (inside,outside) tcp interface https https netmask

static (inside,outside) tcp interface www www netmask

access-group ouside-acl in interface outside


router eigrp 1






route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http inside

http inside

http inside

no snmp-server location

no snmp-server contact

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet inside

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect http

  inspect ils


service-policy global_policy global

prompt hostname context


: end

Everyone's tags (6)

Re: PIX Port Forward with Two IP Address


If you truly have 2 addresses outside of the one that's on your interface, you can nat those like you did your other statics in your running config:

static (inside, outside) tcp 80 80 netmask

static (inside, outside) tcp 80 80 netmask

If you have a different public address going to each internal server, then you won't have any issues. You'll need to allow the traffic into your network through your outside-acl and you should be good to go...



HTH, John *** Please rate all useful posts ***
Hall of Fame Super Silver

PIX Port Forward with Two IP Address

Hello Jonathan,

you could attempt the following


access-list ouside-acl extended permit tcp any host eq www

static (inside,outside) tcp www www netmask

this should allow to use access on TCP port 80, otherwise you need to change the port used on the outer world if you want to map to outside interface

Hope to help