asked on
Mapping (1) Outside IP to (2 ) inside servers
What would be the best way to map one public IP address (Outside-DSS) to two different servers one will feed webpages, the other will be used for lpd printing. Both servers must be reachable from the inside and outside (they will be located off of the Inside interface not the DMZ interface).
I currently have both services (web and lpd printing) running on one server (DSS-Server), but would like to move lpd printing to a separate server (lpd-Server). I currently just have one static statement (see below) mapping the outside address (Outside-DSS) to the DSS-Server.
access-list outside_acl remark Web Site to DSS
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl remark lpd Printing
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd
static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
access-group outside_acl in interface Outside
I currently have both services (web and lpd printing) running on one server (DSS-Server), but would like to move lpd printing to a separate server (lpd-Server). I currently just have one static statement (see below) mapping the outside address (Outside-DSS) to the DSS-Server.
access-list outside_acl remark Web Site to DSS
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl remark lpd Printing
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd
static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
access-group outside_acl in interface Outside
Software FirewallsCisco
Last Comment
Zahler
correction to static statement above (lines got overlapped):
static (inside,outside) tcp interface www [inside ip address of server] www netmask 255.255.255.255
static (inside,outside) tcp interface www [inside ip address of server] www netmask 255.255.255.255
ASKER
How does this look?
These are the access lists for the services I want port-forwarded:
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd
These are the static NAT statements to NAT the public ip to the inside private ip addresses. One outside address (Outside-DSS) is being port NATed to two inside address:
static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
static (Inside,Outside) Outside-DSS lpd-Server netmask 255.255.255.255
These are the access lists for the services I want port-forwarded:
access-list outside_acl extended permit tcp any host Outside-DSS eq www
access-list outside_acl extended permit tcp host DHHS host Outside-DSS eq lpd
These are the static NAT statements to NAT the public ip to the inside private ip addresses. One outside address (Outside-DSS) is being port NATed to two inside address:
static (Inside,Outside) Outside-DSS DSS-Server netmask 255.255.255.255
static (Inside,Outside) Outside-DSS lpd-Server netmask 255.255.255.255
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Thanks!! Unfortunately, I cant test this on the firewall yet, but I understand the configuration.
simply add access lists for the services your want port-forwarded, add the static NAT statements to NAT the public ip to the inside private ip address
here is an example:
access-list outside_access_in extended permit tcp any interface outside eq www static (inside,outside) tcp interface www [inside ip address of server] www netmask 255.255.255.255
access-group outside_access_in in interface outside