topic Re: PIX bind to two IP's in Network Security

PIX bind to two IP's

lgelinas — Fri, 21 Feb 2020 06:28:24 GMT

Can I bind my pix 515 to multiple Outside IP's? I want to use port 80 to get to my web server on one external IP and port 80 on a different IP to another internal server. If yes Then how ... (programming humour intended)

Thanks

L.Gelinas

lgelinas@healthspace.ca

Re: PIX bind to two IP's

gfullage — Tue, 07 Jan 2003 02:21:36 GMT

Sure, just use port redirection with your statics.

> static (inside,outside) tcp 200.1.1.1 80 10.1.1.1 80 netmask 255.255.255.0

> static (inside,outside) tcp 200.1.1.2 80 10.1.1.2 80 netmask 255.255.255.0

> access-list inbound permit tcp any host 200.1.1.1 eq www

> access-list inbound permit tcp any host 200.1.1.2 eq www

> access-group inbound in interface outside

where 200.1.1.1 and 200.1.1.2 are the two external IP addresses, and 10.1.1.1 and 10.1.1.2 are the two internal hosts that they map to. You'll obviously have to get these external addresses assigned to you by your ISP and have them routed to your PIX.

Keep in mind that you can't do something like:

> static (inside,outside) tcp 200.1.1.1 80 10.1.1.1 80 netmask 255.255.255.0

> static (inside,outside) tcp 200.1.1.2 80 10.1.1.1 80 netmask 255.255.255.0

where two outside addresses are mapped to one internal address (or vice versa), but as long as each port redirection (for the same port number) goes to a different host then you'll be OK.

Re: PIX bind to two IP's

gfullage — Wed, 08 Jan 2003 00:01:35 GMT

Whoops, just noticed my netmasks on the static commands I suggested are wrong. They should be 255.255.255.255, not 255.255.255.0 as I wrote.

Re: PIX bind to two IP's

lgelinas — Wed, 08 Jan 2003 16:58:32 GMT

I got the jist! thanks