topic Direct traffic based on source URL in Network Security

Direct traffic based on source URL

Michael Kim — Mon, 11 Mar 2019 21:38:31 GMT

Hello,

Has anyone configured their Cisco ASA to do port based forwarding based on the incoming URL address? By this I mean lets say I have a web page hosted on the Internet with two links 1) www.website1.com 2) www.website2.com. Let's assume I have a Cisco ASA with a single useable IP address to the Internet (OUTSIDE interface). I also have two web servers on the DMZ interface on the same ASA. Is it possible to configure the ASA to port foward incoming traffic to a particular DMZ web host (port 80) based on the link they clicked? So if a user click on link www.website1.com then traffic would be fowarded to DMA web server1 and if the same user clicks on www.website2.com then the ASA would direct traffic to DMZ web server2?

Note that in this scenario only a single ip address exists to the Internet. Can this be done with static NAT'ing? Running 8.2.2 firmware.

Thanks in advance.

Direct traffic based on source URL

Julio Carvajal — Mon, 17 Oct 2011 02:00:24 GMT

Hello,

Lets say Outside Ip address is 162.10.10.2,DMZ_Server_1 is 192.168.10.2, DMZ_Server_2 is 192.168.10.3.

So the configuration on 8.2.2 required to allow this would be:

Static (Dmz,outside) tcp interface 80 192.168.10.2 80

Static (Dmz,outside) tcp interface 8080 192.168.10.3 80

Access-list outside_in permit tcp any host 162.10.10.2 eq 80

Access-list outside_in permit tcp any host 162.10.10.2 eq 8080

Access-group outside_in in interface outside

Hope this helps,

Have a great day,

Julio

Direct traffic based on source URL

Michael Kim — Mon, 17 Oct 2011 02:16:18 GMT

Thanks for the reply Julio.

Question: Based on the config you have given above how does the ASA know that to which DMZ web server to direct the incoming connection? To put it another way if a user types into their browser www.website2.com how does the ASA determine that it should go to 192.168.10.3 instead of 192.168.10.2?

I was half expecting that the ASA would "read" the URL address and use that as a determination to direct the incoming connection to the apporpriate DMZ web server.

Thanks,

Mike

Direct traffic based on source URL

Julio Carvajal — Mon, 17 Oct 2011 02:43:58 GMT

Hello,

The thing is that as long as I know the ASA cannot make portforwarding based on an URL. That is why we would need to use the IP address of the webserver.

Now each domain has an Ip address right, that is why we use the Domain name system(DNS),and in this case 192.168.10.2 and .3 are going to be linked to www.website1.com and www.website2.com.

So as soon as the ASA sees a request going to those address is going to redirect the traffic to that server.

By the way if you want to access these servers from the inside network or the DMZ network using the Public IP you will need to do DNS Doctoring.

Here is one document that explains this Feature ( DNS doctoring)

http://www.techrepublic.com/blog/networking/cisco-asa-and-dns-pain-is-there-a-doctor-in-the-house/1140

Hope this helps,

Julio

Direct traffic based on source URL

Michael Kim — Mon, 17 Oct 2011 02:56:01 GMT

It's disappointing that the ASA can not port foward traffic from the outside based on URL. We are currently using a Microsoft ISA server that is able to direct traffic based upon the source URL (so i'm told).

Thanks for the link on DNS Doctoring as that was another issue I was going to try and tackle.

Mike

Direct traffic based on source URL

Julio Carvajal — Mon, 17 Oct 2011 05:03:49 GMT

Hello,

I am glad the DNS doctoring document help you.

You do not have to worry regarding the URL issue, the set up is going to work, I believe that at this moment you have 2 domain names for those servers on the dmz and each domain name is linked to an IP address so anyone on the outside is going to be able to access the webserver using the URL.

Regards,