PAT for two web servers

[Aleksey_V_E]

Hello all.

I want to change the MS ISA server for Cisco ASA but i have problem with PAT.

In MS ISA server configured static PAT for two web servers, example.web1.com inside address 192.168.1.10 and example.web2.com inside address 192.168.1.11, both addresses are published under the same internet address 1.1.1.1.

When user try open web page example.web1.com from internet MS ISA server create translates to internal address 192.168.1.10

When user try open web page example.web2.com from internet MS ISA server create translates to internal address 192.168.1.11.

In example cisco uses only address:

static (inside,outside) tcp 1.1.1.1 www 192.168.1.10 www netmask 255.255.255.25

but i have two web servers uses same port 80 and same outside address 1.1.1.1

ASA can create translation for URL? For example :

static (inside,outside) tcp example.web1.com www 192.168.1.10 www netmask 255.255.255.255

static (inside,outside) tcp example.web2.com www 192.168.1.11 www netmask 255.255.255.255

[Jouni Forss · Accepted solution]

Hi,

To my understanding this kind of NAT is not possible in the ASA.

The ASA doesnt have anything to differentiate the 2 translations from eachother other than the order of the NAT configurations. Though I think in your software level it wont even accept the second NAT configuration as it overlaps with the first one. In the newer software it would accept the second configuration but traffic would still hit only one of the NAT configurations.

There must be something on the MS ISA that in addition to the overlapping NAT knows which Static PAT to choose based on the web page requested?

- Jouni

[blau grana]

Hello,

As Jouni wrote, it is not supported ->

Configuring a Network Object

A network object can contain a host, a network IP address, or a range of  IP addresses, a fully qualified domain name (FQDN). You can also enable  NAT rules on the object (excepting FQDN objects).

http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/acl_objects.html#wp1543669

Best Regards

Please rate all helpful posts and close solved questions

[Aleksey_V_E]

Thank you all for your answers

.

JouniForss I do not know how works ISA, but I think ISA looks URL for incoming http GET requests and having this information creates the desired translates.