topic Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall in Network Security

Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Fri, 21 Feb 2020 21:54:03 GMT

Hi,

i have vlans on my network that are natted to the outside to go on the internet, now i want to publish a server on the internet.

i have a public ip for the internet on a cisco ASA firewall interface, i want to add another public ip on the same interface, so that i can port forward to the server i want to publish through this new public ip?

is this possible? What are your suggestions please?

Thanks in advance!

@ASA @Firewall @cisco @public

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Fri, 21 Feb 2020 21:59:35 GMT

Hi,

You cannot assign a 2nd IP address to an interface, but you can use NAT.

object network SRV1
 host 192.168.1.20
 nat (inside,outside) static 1.1.1.2
access-list OUTSIDE_IN permit tcp any host 192.168.1.20 eq 443
access-group OUTSIDE_IN in interface OUTSIDE

As long as your ISP is routing the new IP address (e.g. 1.1.1.2) to the ASA, this should work fine.

HTH

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Fri, 21 Feb 2020 22:07:55 GMT

so for example if i am using 1.1.1.1 for internet, i can use this 1.1.1.2 for the port forwarding into my server? and these are on the same interface?

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Fri, 21 Feb 2020 22:18:37 GMT

Yes, you could use that secondary address just for the port forwarding.
Yes, this NAT would be configured on the outside interface, as per the example I provided above.
Just amend the IP addresses, port and ACL to fit your requirements.

HTH

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Fri, 21 Feb 2020 22:24:21 GMT

oh ok, thank you so much, i will try it and then will reply if it worked, thanks!

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:02:38 GMT

i have an interface on the ASA that i want to assign the public ip i want to publish the server through, is this methodology correct, i will apply the public ip to this interface, and then i will use the same configuration you told me to use, will this work? for example, this is the configuration:

interface GigabitEthernet1/1
security-level 100
ip address 1.1.1.1 255.255.255.0

exit
object network serverpublish
host 192.168.2.1
nat (inside,outside) static 1.1.1.1
access-list OUTSIDE_IN permit tcp any host 192.168.2.1 eq 443
access-group OUTSIDE_IN in interface OUTSIDE

is this good?

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Tue, 25 Feb 2020 22:11:31 GMT

Is GigabitEthernet1/1 meant to be the outside interface? It's security-level should be 0 not 100 and also needs a "nameif".

If you already have another outside interface defined, then you just need to define the object and the nat entry....as long as the upstream ISP router knows to route to the ASA.

If you are still unclear, provide your full configuration and the nat ip address you wish to use.

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:18:38 GMT

i have an interface in which it has the public ip used to give internet, and all vlans are coming out of this interface so all has internet, now i want to use another interface in which i give another public ip, so that users outside on the internet can access the server inside that i want to publish, so i want to port forward users outside to such server

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Tue, 25 Feb 2020 22:51:10 GMT

So if you already have 1 "outside" interface, then you just need to define a nat.

object network serverpublish
host 192.168.2.1
nat (inside,outside) static 1.1.1.x
access-list OUTSIDE_IN permit tcp any host 192.168.2.1 eq 443
access-group OUTSIDE_IN in interface OUTSIDE

You may need to amend the nat rule above if your inside interface is not called "inside" and your outside interface is not called "outside".

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:23:59 GMT

this will be the full configuration:

interface GigabitEthernet1/2
nameif Fwoutinternet
security-level 0
ip address 1.1.1.1 255.255.255.248
interface GigabitEthernet1/3
nameif Fwtoserver
security-level 100
ip address 1.1.1.2 255.255.255.248
exit
object network serverpublish
host 192.168.2.1
nat (inside,outside) static 1.1.1.2
access-list OUTSIDE_IN permit tcp any host 192.168.2.1 eq 443
access-group OUTSIDE_IN in interface OUTSIDE

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Sheraz.Salim — Tue, 25 Feb 2020 22:29:26 GMT

yes this is correct config.

you can test this.

packet-tracer input Fwoutinternet tcp 4.4.4.4 1223 1.1.1.2 eq 443

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:27:22 GMT

so this will allow me to port forward users outside on the internet to use the server inside my network, right?

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Tue, 25 Feb 2020 22:28:42 GMT

You cannot have 2 interfaces in the same subnet, 1.1.1.1 and 1.1.1.2 are in the same network.
You don't need to define an IP address on the physical interface Gi1/3. You just need the NAT.

You will need to change the nat rule as "outside" appears to be "Fwoutinternet"

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:51:42 GMT

object network serverpublish
host 192.168.2.1
nat (inside,Fwoutinternet) static 1.1.1.2
access-list OUTSIDE_IN permit tcp any host 192.168.2.1 eq 443
access-group OUTSIDE_IN in interface OUTSIDE

So only this will port forward users outside the internet to my server?

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Rob Ingram — Tue, 25 Feb 2020 22:55:06 GMT

Correct. If a user connects to https://1.1.1.2 from the internet then this will port forward to https://192.168.2.1

You need to amend your access-group:-

access-group OUTSIDE_IN in interface Fwoutinternet

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Tue, 25 Feb 2020 22:55:34 GMT

Thank you so much, i will try it later on, and then reply here and accept solution if it worked, thanks again!

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Wed, 26 Feb 2020 07:30:39 GMT

this wont affect the ip 1.1.1.1 on the interface 1?, because we are using the same interface which is fwoutinternet

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Sheraz.Salim — Wed, 26 Feb 2020 17:55:22 GMT

it wont effect as RJ mentioned this already to you. make the change and test it. in order to test once you apple your configration.

packet-tracer input fwoutinternet tcp 8.8.8.8 12345 1.1.1.2 eq https

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

AhmadZ — Wed, 26 Feb 2020 18:04:56 GMT

ASA# packet-tracer input FwoutTerra tcp 8.8.8.8 1234 1.1.1.2 443

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network OWApublish
 nat (FwInside,FwoutTerra) static 1.1.1.2
Additional Information:
NAT divert to egress interface FwInside
Untranslate 1.1.1.2/443 to 172.16.12.7/443

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group OUTSIDE_IN in interface FwoutTerra
access-list OUTSIDE_IN extended permit tcp any host 172.16.12.7 eq https
Additional Information:

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: SFR
Subtype:
Result: ALLOW
Config:
class-map class
 match any
policy-map map
 class class
  sfr fail-open
service-policy map global
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network OWApublish
 nat (FwInside,FwoutTerra) static 1.1.1.2
Additional Information:

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 46591092, packet dispatched to next module

Result:
output-interface: FwInside
output-status: up
output-line-status: up
Action: allow

this is the output, seems everything is fine

Re: Adding Multiple Public IPs on a Single Interface on Cisco ASA Firewall

Sheraz.Salim — Wed, 26 Feb 2020 18:09:29 GMT

yes it look good. you should be good now. you nat rules is working accordingly.