Cisco ASA 5525 Single External IP to Multiple HLB Internal VIP Services

We have a hardware load balancer that is load balancing several exchange related services to internal virtual IPs (VIP).

My question is can we use a single external Public IP to route the external services into multiple internal VIPs based on service?

Example:

External IP: 208.111.111.100

Internal VIPs:
10.1.102.2 - 443 (HTTPS)
10.1.102.3 - 143 (IMAP)
10.1.102.4 - 993 (IMAPS)
10.1.102.5 - 25 (SMTP)

So one external IP, routing traffic internally to different internal IPs based on service. I'm drawing a blank tonight, perhaps I've been thinking on it too much! It's most likely right in front of my face. Any suggestions or recommendations? I'm trying to utilize only 1 external IP for my exchange traffic.
LVL 1
danherbonAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

kevinhsiehCommented:
Yes, it can be done. FWIW, I would not allow IMAP because passwords would be sent in cleartext, and I would also not allow authentication over SMTP in cleartext. Actually, why IMAPS at all? These days use OWA, ActiveSync, or Outlook. Any client using IMAP is really legacy.

object network VIP-HTTPS-10.1.102.2
 host 10.1.102.2
 description VIP-HTTPS

object network VIP-IMAP-10.1.102.3
 host 10.1.102.3
 description VIP-IMAP

object network VIP-IMAPS-10.1.102.4
 host 10.1.102.4
 description VIP-IMAPS

object network VIP-SMTP-10.1.102.5
 host 10.1.102.5
 description VIP-SMTP

object network VIP-HTTPS-10.1.102.2
 nat (inside,Outside) static 208.111.111.100 service tcp 443 443

object network VIP-IMAP-10.1.102.3
 nat (inside,Outside) static 208.111.111.100 service tcp 143 143

object network VIP-IMAPS-10.1.102.4
 nat (inside,Outside) static 208.111.111.100 service tcp 993 993

object network VIP-SMTP-10.1.102.5
 nat (inside,Outside) static 208.111.111.100 service tcp 25 25

Open in new window

kevinhsiehCommented:
...and since you're using only 1 external IP for exchange, why so many internal VIPs? You should be able to use a single VIP for all of the services. Double check your load balancer configuration options as this is much more complicated than what it should be.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.