A pix port redirection question

[xbw]

I have only one public ip address.It was used by outside interface.How can I allow outside host to access to internal

web server?

[itchampnz]

Hi, you have 2 options.

If you can use that public ip for just the webserver and nothing else then a standard static would do.

However if you want to prepare for expansion later, you would need to utilise port forwarding, so you would set it up to forward any port 80 traffic to the privately addressed inside ip address. This is by far the recommended way.

See here for details.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml

[jackko]

one way is to configure port forwarding on the pix.

e.g.

static (inside,outside) tcp 80 80 netmask 255.255.255.255 0 0

access-list 100 permit tcp any host eq 80

access-group 100 in interface outside

clear xlate

the last command "clear xlate" is used to force the pix to refresh the existing address translation, so that the new static statement will be kicked off.

[jmia · Accepted solution]

As per Jack Ko's post, you could also use keyword: interface on your static i.e. if you only have one public IP and this IP is being used for the PIX outside interface:

static (inside,outside) tcp interface 80 80 netmask 255.255.255.255 0 0

-or-

For SMTP access:

access-list 100 permit tcp any host eq smtp

access-group 100 in interface outside

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Again, save with: write mem and also issue: clear xlate

Hope this helps,

Jay

[bobfuller]

I've been trying to do a similar port forward, however have been unsuccessful. My outside address is obtained from my ISP's dhcp and is not static. This is from a cable modem connection, residential service.

I'm trying to effectively do what standard home retail routers like Linksys or any others do.

Is this possible over a DHCP'd single address service?

TIA,

Bob