[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1658
  • Last Modified:

Problem publishing servers with ISA and Cisco ASA 5520

The configuration that I want to use is to have our Cisco ASA 5520 filtering traffic from the Internet and our DMZ and the ISA server will sit behind that connected to our internal network.  The problem that I have is we need to publish several servers using different public IPs statically NATd throught the ISA.  The Cisco ASA will only allow me to map 1 public IP to the outside interface on the ISA server.  But I need to have 4 different IP statically NATs to the ISA for the servers.  Moving the servers into the DMZ or in front of the ISA are not an option today.
0
WH_Tech
Asked:
WH_Tech
  • 5
  • 2
1 Solution
 
ngravattCommented:
you should be able to set up static one-to-one NAT commands on the ASA.

the command will be similar to this;

static (DMZ,outside) tcp 4.4.4.4 web 10.10.10.10 web netmask 255.255.255.255
0
 
WH_TechAuthor Commented:
Yes. The problem I am having though is that the ASA will only allow me to map one public IP to the outside interface of the ISA server.  If I try to add a second static mapping to the ISA interface, I get an error about overlapping IP mappings.
0
 
ngravattCommented:
or without PAT the command looks like this:

static (DMZ,outside) 4.4.4.4 10.10.10.10 netmask 255.255.255.255

where 10.10.10.10 is the ip address of the DMZ server

and
 4.4.4.4 is the IP address you want the firewall to give the DMZ server
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
ngravattCommented:
what is the subnet mask you have assigned to the outside interface of the ASA?
0
 
ngravattCommented:
"I get an error about overlapping IP mappings"

that means your other NAT commands are already performing NAT for those IP addresses.  Do you have some other NAT commands for traffic going from DMZ to outside?
0
 
WH_TechAuthor Commented:
Maybe this will  help clairify what I am trying to do:

We currently have a Cisco ASA5520 and I want to use ISA Server 2006 for a web proxy/caching and to publish some of our internal servers.  Can the two of these be configured to work in tandem?  The servers are statically mapped to separate public IPs on the Cisco ASA.  Can ISA 2006 publish server mapped to separate Public IPs.  The Cisco ASA will not let me map several different Public IPs to the same private IP, like the outside interface of the ISA server.
 
Here is a rough example of our layout:
 
Internet----Router----Cisco ASA----ISA Server----Private LAN
                                         |                                                |
                                     DMZ                               Servers to be published

0
 
ngravattCommented:
oh i see now.  this would be a question of the ISA server. i got a microsoft guy here that says it can be done here is what he says:

set up a separate rule to publish each web site through the ISA server

here a definition of the rule to use.

Public Address DMZ with Route Relationship using Access Rules :

This configuration allows you connect to your DMZ hosts using their actual public addresses. The log files on the published servers will show the original source IP address of the remote host. The exception is when you create an Access Rule to connect to an HTTP server on the DMZ segment. In this case, the ISA Server 2006 firewalls IP address will appear as the source address. This can be corrected by disabling the Web Proxy filter on the rule.

for this, just assume the public IP address is really the private IP address you want the ASA to see.
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now