ASA Firewall Access Rule for Web Servers

Posted on 2014-12-24
Last Modified: 2015-11-07
In ASA 5520 I have configured an Access Rule so that outside client can reach the Webserver in the DMZ. It worked with no problem. However , so far I have only one Webserver in the DMZ and the access rule is permitting from outside to the destination (Webserver object) which has an IP address
In real world there should be redundant Webservers in the DMZ, so that they can "Load Balance" the load.
I wonder if I need to create separate Access Rule for each Webserver or there is a simpler way to do it ?

Any help will be very much appreciated.

Thank you

Question by:jskfan
  • 3
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 250 total points
ID: 40516905
The firewall is not a load balancer, if you want load balancing buy a load balancer?

You would need to set each web server with its own public IP address then you could load balance using DNS round robin.

Or if you are using  server 2012 - you could reverse proxy and use NLB.


Author Comment

ID: 40517004
I am not saying I need to Load balance with Firewall.

Usually companies do not use just one web server in the DMZ. They use a bunch of them and I believe in DNS they create CNAME so that all webservers will have the same name but different IP addresses...

Well... the way I configured ASA in the LAB, was not complicated because I just allowed HTTP from outside to go to that single webserver IP address. in the case when there are several webservers, how do you change the access rules so that it will apply to all webservers in the DMZ?
hope the Question is clear now..
LVL 50

Accepted Solution

Don Johnston earned 250 total points
ID: 40517044
Usually companies do not use just one web server in the DMZ. They use a bunch of them and I believe in DNS they create CNAME so that all webservers will have the same name but different IP addresses...
I believe that what you're referring to is "content switching".

Author Comment

ID: 40517689

in your comment above you mentioned Load Balancer, I believe that would work if you put it in the DMZ (Of course), that way you Load balance between WebServers, and the WebServers will have a common Virtual IP address.
I believe that Virtual IP address is the IP address that will be used in ASA Firewall Access Rule. It makes more sense to me this way.

Author Closing Comment

ID: 41205064
Thank you

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Opening Ports 18 83
Using VLAN Interface in ASA 5 22
nexus filter logs 3 29
Cisco 1811W VLAN configuration problem 3 13
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now