PIX Port Forwarding Question

I have a Cisco PIX 515E and have a total of 4 static public IPs. I am currently using 3. I need to forward 11 ports (5500 to 5510) to 11 different IPs (not sequencial and in different Subnets).

I'm not exactly sure how to do this.

Here are the scenarios i imagine but really not sure if possible:

- Use my last public IP and set it up to NAT these 11 IPs and forwards ports to the computers.

- Forward the ports on my IP that is being used for NAT to the net.

Really not sure how to do any of this.

Any help would be appreciated

Thanks
inf2300Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

daocsCommented:
First you will need to allow the traffic through an access-list

access-list outin permit tcp any host Public_ip eq 5500
access-list outin permit tcp any host Public_ip eq 5501
access-list outin permit tcp any host Public_ip eq 5502
access-list outin permit tcp any host Public_ip eq 5503
etc..

Apply the access-list to an interface
access-group outin in interface outside

Statically map the outside ip to an inside ip for just the port you want
static (inside,outside) tcp Public_ip 5500 Inside_IP#1 5500 netmask 255.255.255.255
static (inside,outside) tcp Public_ip 5501 Inside_IP#2 5501 netmask 255.255.255.255
static (inside,outside) tcp Public_ip 5502 Inside_IP#3 5502 netmask 255.255.255.255
static (inside,outside) tcp Public_ip 5503 Inside_IP#4 5503 netmask 255.255.255.255
etc...

Is this what you are trying to do?

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
inf2300Author Commented:
Hi Daocs,

That looks great!! can i do this on my IP which is being used by all my client's to access the net. Basically the ip that is being used for NAT or will this cause problems

Thanks
0
daocsCommented:
Hey Inf2300,

Sorry for the delay, my email wasn't coming through until today.

Yes you can use your Nat Ip, just type 'interface' instead of the public ip or if you do type the actual IP the config will automatically put the word in for you.

The only way you can not use the NAT ip (or any for that matter) is if you already have a static statment using all the ports instead of just one.

Let me know if you have anymore questions.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.