Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX Port Forward with Two IP Address

I have to static IP address from my ISP.  I am going to be hosting two web servers, one per IP address.  How do I get the PIX to route each external IP to the correct web server?

I currently have one setup and works just fine, but I am trying to figure out how to get the second one to work. Can I use port 80 for both or will I need to change that as well.

Below is my current config:

External IP Address

xxx.xxx.118.208  ---> Currently hosting and working fine

xxx.xxx.118.221  ---> Future Web Site

Web Servers

192.168.2.22  ----> Working web server

192.168.2.24 ---> Furture web server

PIX Version 8.0(4)32

!

hostname pixfirewall

domain-name jkkcc.com

enable password DQucN59Njn0OjpJL encrypted

passwd DQucN59Njn0OjpJL encrypted

no names

!

interface Ethernet0

nameif outside

security-level 0

ip address xxx.xxx.118.208 255.255.255.224

!

interface Ethernet1

nameif inside

security-level 100

ip address 10.0.20.1 255.255.255.248

!

interface Ethernet2

shutdown

nameif exchange

security-level 100

ip address 10.0.30.1 255.255.255.248

!

ftp mode passive

dns domain-lookup inside

dns server-group DefaultDNS

name-server 68.105.28.16

name-server 68.105.29.16

domain-name jkkcc.com

access-list ouside-acl extended permit tcp any host xxx.xxx.118.208 eq smtp

access-list ouside-acl extended permit tcp any host xxx.xxx.118.208 eq www

access-list ouside-acl extended permit tcp any host xxx.xxx.118.208 eq https

pager lines 24

mtu outside 1500

mtu inside 1500

mtu exchange 1500

icmp unreachable rate-limit 1 burst-size 1

icmp deny any outside

asdm image flash:/asdm-602.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface smtp 192.168.2.22 smtp netmask 255.255.255.255

static (inside,outside) tcp interface https 192.168.2.22 https netmask 255.255.255.255

static (inside,outside) tcp interface www 192.168.2.22 www netmask 255.255.255.255

access-group ouside-acl in interface outside

!

router eigrp 1

network 10.0.0.0 255.0.0.0

network 192.168.0.0 255.255.255.0

network 192.168.2.0 255.255.255.0

network 192.168.4.0 255.255.255.0

!

route outside 0.0.0.0 0.0.0.0 24.234.118.193 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http 0.0.0.0 0.0.0.0 inside

http 10.0.20.0 255.255.255.248 inside

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect http

  inspect ils

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:abd41b3df257873d44a6fc1545ae4418

: end

Everyone's tags (6)
2 REPLIES

Re: PIX Port Forward with Two IP Address

Jonathan,

If you truly have 2 addresses outside of the one that's on your interface, you can nat those like you did your other statics in your running config:

static (inside, outside) tcp 80 192.168.2.22 80 netmask 255.255.255.255

static (inside, outside) tcp 80 192.168.2.24 80 netmask 255.255.255.255

If you have a different public address going to each internal server, then you won't have any issues. You'll need to allow the traffic into your network through your outside-acl and you should be good to go...

HTH,

John

HTH, John *** Please rate all useful posts ***
Hall of Fame Super Silver

PIX Port Forward with Two IP Address

Hello Jonathan,

you could attempt the following

add

access-list ouside-acl extended permit tcp any host xxx.xxx.118.221 eq www

static (inside,outside) tcp xxx.xxx.118.221 www 192.168.2.22 www netmask 255.255.255.255

this should allow to use access on TCP port 80, otherwise you need to change the port used on the outer world if you want to map to outside interface

Hope to help

Giuseppe

550
Views
0
Helpful
2
Replies