topic Re: How do I force an internal host or network to use a specific ip address on outbound http requests in Network Security

How do I force an internal host or network to use a specific ip address on outbound http requests

twhitney — Fri, 21 Feb 2020 17:51:35 GMT

Hi Everyone,

I have a natted Internal Webserver, which is working thanks to the guidelines found here

https://community.cisco.com/t5/firepower/acl-to-publish-my-internal-website-help-please/m-p/4016305#M16461

Now how do I force that same server to send its own http requests to any external website as the external ip address that it is set up to nat?

Right now all requests are appearing as the default IP of the FMC device.

I need it to appear as the specific ip.

Any guidance is appreciated.

Re: How do I force an internal host or network to use a specific ip address on outbound http requests

Francesco Molino — Thu, 23 Jan 2020 21:22:16 GMT

Here a screenshot on how you can do it

You need to make sure it is placed before the global nat rule 1 in your screenshot from the other post (the one natting everything for internet access).

This will nat traffic source from http port to any port on the outside.

Re: How do I force an internal host or network to use a specific ip address on outbound http requests

Rob Ingram — Thu, 23 Jan 2020 21:23:33 GMT

Hi,

Try something like this:-

Ensure this new rule is above your default rule that would normally nat the outbound traffic. If a connection is already established you will need to clear the existing xlate/nat connections with the command from the cli "clear xlate". Be careful doing that in production.

HTH

Re: How do I force an internal host or network to use a specific ip address on outbound http requests

twhitney — Fri, 24 Jan 2020 19:17:08 GMT

Thank you both,

Both solutions work.

I really do appreciate the help.

Re: How do I force an internal host or network to use a specific ip address on outbound http requests

Francesco Molino — Sat, 25 Jan 2020 02:33:24 GMT

You're welcome