Port Forwarding based on FQDN - Cisco ASA 5512

[Fabian Scott]

I have 2 domain names and one external Public IP (71.22.222.22) using Port 443. I need to forward traffic based on the FQDN.

Is it possible to have this setup & how:

1st domain: first.example.com    (71.22.222.22) -------> Local Server 10.2.2.10

2nd domain: second.example.com (71.22.222.22) -------> Local Server 10.2.2.11

Thanks

[Aditya Ganjoo]

Hi Fabian,

If you are using a single Public IP with the same port then it would not be supported on the ASA as per design. You need to either use a different port or a different IP.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Karsten Iwen · Accepted solution]

There are a couple of choices here:

• As already mentioned, give both of them a unique public IP
• Install a reverse-proxy in your network (ideally in a DMZ) and forward all TCP/443 to that server. The reverse-Proxy can then look into the request and send the traffic to the right server. This would be my preferred approach.
• Install FirePower on your ASA (the ASA needs to be quipped with an SSD) and configure SSL/TLS inspection and forwarding in FirePOWER. This option gives you an additional security compared to using the second option alone.