Link to home
Create AccountLog in
Avatar of Zahler
Zahler

asked on

Mapping (1) Outside IP to (2 ) inside servers

What would be the best way to map one public IP address (Outside-DSS) to two different servers  one will feed webpages, the other will be used for lpd printing.  Both servers must be reachable from the inside and outside (they will be located off of the Inside interface not the DMZ interface).

I currently have both services (web and lpd printing) running on one server (DSS-Server), but would like to move lpd printing to a separate server (lpd-Server).  I currently just have one static statement (see below) mapping the outside address (Outside-DSS) to the DSS-Server.

access-list outside_acl remark Web Site to DSS  
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl remark lpd Printing
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd

static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
access-group outside_acl in interface Outside
Avatar of bignewf
bignewf
Flag of United States of America image

This is the port forwarding access-list and corresponding static NAT statement to  port forward web services using one public ip address
simply add access lists for the services your want port-forwarded, add the static NAT statements to NAT the public ip to the inside private  ip address

here is an example:

access-list outside_access_in extended permit tcp any interface outside eq www static (inside,outside) tcp interface www [inside ip address of server] www netmask 255.255.255.255
access-group outside_access_in in interface outside
correction to static statement above  (lines got overlapped):

static (inside,outside) tcp interface www [inside ip address of server] www netmask 255.255.255.255
Avatar of Zahler
Zahler

ASKER

How does this look?

These are the access lists for the services I want port-forwarded:
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd

These are the static NAT statements to NAT the public ip to the inside private ip addresses. One outside address (Outside-DSS) is being port NATed to two inside address:
static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
static (Inside,Outside) Outside-DSS lpd-Server netmask 255.255.255.255

ASKER CERTIFIED SOLUTION
Avatar of bignewf
bignewf
Flag of United States of America image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Avatar of Zahler

ASKER

Thanks!!  Unfortunately, I cant test this on the firewall yet, but I understand the configuration.