Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Port redirection to another subnet

I am having a problem with incoming port redirection. I have allowed Lotus Notes traffic to a server which resides on a different subnet than the PIX, but I can't connect to it. I set up port redirection to another server that is on the same subnet as the PIX with no problems. Is there something that I need to do, other than setting up routes, to make it work?

New Member

Re: Port redirection to another subnet

Just check if you have a "route" statement who targets to this subnet.


New Member

Re: Port redirection to another subnet

There is a route to this subnet. As I mentioned, there are 2 allowed inbound connections but only the one to the local subnet works. I'll include the relevant lines below:

ip address outside

ip address inside

global (outside) 1 interface

access-list acl_out permit tcp any host eq lotusnotes

access-list acl_out permit tcp any host eq https

access-group acl_out in interface outside

static (inside,outside) tcp interface lotusnotes lotusnotes netmask 0 0

static (inside,outside) tcp interface https 10000 netmask 0 0

route inside 2

New Member

Re: Port redirection to another subnet


I don't think the problem is about the route but just to be sure, you can try:

- route inside 1


- route inside 1

The second route statement will force the PIX to send an ARP0 locally to find the destination on the first inside subnet. The router, if it's a Cisco one, should respond to this ARP (Proxy ARP feature), then the PIX will send packets to the right place.

If those variants of route don't work, you will have to enter in logging mode, debug level, to see what's happen.

Hope this help!



New Member

Re: Port redirection to another subnet

I tried both of these options with no success. When I tried looking at the debugging information there is nothing showing up except traffic from the network.

Something else that has emerged is that no other network except the one the PIX is on (inside) can directly access the internet. They can ping the PIX and access PDM, but not the internet. On the network I can use WS_FTP with the firewall option configured to access external sites, but not from any other subnet.

One thing to note is that the PIX is not our default gateway. We use a proxy (Squid) to access the internet. Because the proxy was placed on the network, I had't noticed the problem.