Thanks for the help dude.
I have lots of other static 1-to-1 static NAT addresses configured. Will those be gone when I run the clear xlate command?
Main Topics
Browse All TopicsHello,
I need the CLI command to perform port forwarding. In other words, I have a public IP address, let's say 1.1.1.1. I need port 80 to forward to a private IP address of 2.2.2.2 (to the same port, port 80). I know that the command to do this is:
static (inside,outside) 1.1.1.1 2.2.2.2 netmask 255.255.255.255
access-list outside_in permit tcp 80 any host 1.1.1.1 eq 80
What command would I have to use if say, someone (outside) requests port 443 on public IP 1.1.1.1 and I need the request to be routed to a different IP with a different port? In other words, someone types https://1.1.1.1 (443=SSL), how do I set up the router so that it doesn't go to private IP 2.2.2.2 but to a different private IP, say 3.3.3.3 at port 444?
So, someone requests https://1.1.1.1, the router sends the signal to private IP 3.3.3.3 at port 444.
Please help. Need to set this up as soon as possible.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
D'oh! Sorry about the typo in the ACL, got in a hurry. It should instead read:
access-list outside_in permit tcp any host 1.1.1.1 eq 443
>I have lots of other static 1-to-1 static NAT addresses configured. Will those be gone when I run the clear xlate...
Nope. 'clear xlate' doesn't mess with your config, it just clears the current NAT translation table that the PIX currently has in memory, to ensure correct behavior, & so you don't get a "duplicate entry" error.
> static (inside,outside) tcp interface 443 3.3.3.3 444 netmask 255.255.255.255
> In other words anyone trying to access port 443 out of the range of public IP's assigned to the PIX would be directed to port 444 on 3.3.3.3, am I right?
Actually, no. The 'interface' keyword simply means the actual IP of the outside interface. For example, given the following:
ip address outside 68.2.2.2 255.255.255.0
static (inside,outside) tcp interface 443 3.3.3.3 444 netmask 255.255.255.255
The static statement above would map port 443 to the single IP 68.2.2.2, since that's the actual IP of the interface.
And, once again, due to the rules of the PIX's security algorithm, you can't map multiple outside IPs to the same port on the same internal host IP. The workaround for this would be to configure additional IPs on the inside target server, so it answers to multiple IPs, eg: 3.3.3.3, 3.3.3.4, 3.3.3.5, etc.
Then create several individual static NATs like so:
static (inside,outside) tcp 89.1.1.1 443 3.3.3.3 444
static (inside,outside) tcp 89.1.1.2 443 3.3.3.4 444
static (inside,outside) tcp 89.1.1.3 443 3.3.3.5 444 ... and so on
clear xlate
And create ACL entries like so:
access-list outside_in permit tcp any host 89.1.1.1 eq 443
access-list outside_in permit tcp any host 89.1.1.2 eq 443
access-list outside_in permit tcp any host 89.1.1.3 eq 443
Just note that if you want to setup the above, make sure you're not using those public IPs (89.1.1.1-3) in a 'global' statement. eg, if you have something like this:
global (outside) 1 89.1.1.1-89.1.1.10 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
...you'd have to remove those 3 IPs from the NAT pool before assigning the statics above, since you don't want overlap, eg:
no global (outside) 1 89.1.1.1-89.1.1.10 netmask 255.255.255.0
global (outside) 1 89.1.1.4-89.1.1.10 netmask 255.255.255.0
...( add new static entries here )...
clear xlate
cheers
Business Accounts
Answer for Membership
by: calvinetterPosted on 2006-08-12 at 18:43:15ID: 17304012
>I know that the command to do this is:
>static (inside,outside) 1.1.1.1 2.2.2.2 netmask 255.255.255.255
Yes, that's one way to do it. It's basically "1-to-1 static NAT". What you're wanting to do is "port forwarding".
You'll need to change your static NAT config: remove the current 1-to-1 mapping above, then add individual mappings to each port you need forwarded to different internal IPs:
no static (inside,outside) 1.1.1.1 2.2.2.2 netmask 255.255.255.255
clear xlate <-- must run this to ensure the NAT table is cleared
clear local
static (inside,outside) tcp 1.1.1.1 80 2.2.2.2 80 <-- add additional similar lines if other ports are needed
static (inside,outside) tcp 1.1.1.1 443 3.3.3.3 444 <-- ditto
clear xlate <- run once more for good measure
access-list outside_in permit tcp 80 any host 1.1.1.1 eq 443
access-group outside_in in interface outside <- re-apply ACL to interface to ensure changes take effect
FYI: the "access-list" command is simply a security control - allowing/disallowing acess thru the PIX. The static NAT statements are what do the actual work of either forwarding ports or simply doing a 1-to-1 NAT.
cheers