Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

xbw
New Member

A pix port redirection question

I have only one public ip address.It was used by outside interface.How can I allow outside host to access to internal

web server?

1 ACCEPTED SOLUTION

Accepted Solutions
Gold

Re: A pix port redirection question

As per Jack Ko's post, you could also use keyword: interface on your static i.e. if you only have one public IP and this IP is being used for the PIX outside interface:

static (inside,outside) tcp interface 80 80 netmask 255.255.255.255 0 0

-or-

For SMTP access:

access-list 100 permit tcp any host eq smtp

access-group 100 in interface outside

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Again, save with: write mem and also issue: clear xlate

Hope this helps,

Jay

4 REPLIES
New Member

Re: A pix port redirection question

Hi, you have 2 options.

If you can use that public ip for just the webserver and nothing else then a standard static would do.

However if you want to prepare for expansion later, you would need to utilise port forwarding, so you would set it up to forward any port 80 traffic to the privately addressed inside ip address. This is by far the recommended way.

See here for details.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml

Gold

Re: A pix port redirection question

one way is to configure port forwarding on the pix.

e.g.

static (inside,outside) tcp 80 80 netmask 255.255.255.255 0 0

access-list 100 permit tcp any host eq 80

access-group 100 in interface outside

clear xlate

the last command "clear xlate" is used to force the pix to refresh the existing address translation, so that the new static statement will be kicked off.

Gold

Re: A pix port redirection question

As per Jack Ko's post, you could also use keyword: interface on your static i.e. if you only have one public IP and this IP is being used for the PIX outside interface:

static (inside,outside) tcp interface 80 80 netmask 255.255.255.255 0 0

-or-

For SMTP access:

access-list 100 permit tcp any host eq smtp

access-group 100 in interface outside

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Again, save with: write mem and also issue: clear xlate

Hope this helps,

Jay

New Member

Re: A pix port redirection question

I've been trying to do a similar port forward, however have been unsuccessful. My outside address is obtained from my ISP's dhcp and is not static. This is from a cable modem connection, residential service.

I'm trying to effectively do what standard home retail routers like Linksys or any others do.

Is this possible over a DHCP'd single address service?

TIA,

Bob

113
Views
0
Helpful
4
Replies