[c-nsp] can you port forward to a non connected subnet?

Scott Granados gsgranados at comcast.net
Fri Jul 31 14:48:05 EDT 2009


Hi, I have a question RE port forwarding.

BACKGROUND

We have a pix with two interfaces.  One public interface has a static 
outside of 206.x.x.77 and we have an internal interface with an interface IP 
of 10.18.7.254.  On the inside interface we attach a core switch with lots 
of VLANs with different subnets attached and routing enabled in the switch. 
The default route on the core is set to point at 10.18.7.254 and nat is 
enabled.  One of these VLANS has a subnet of 10.18.4.128/26 which hosts some 
servers.  The servers are obviously not directly connected to the segment 
where the Pix is attached but they can route out to the Internet via the pix 
and reach 10.18.7.254 with out issue.  My question is can you map a port 
from the outside to one of the 10.18.4.128/26 servers through the core or 
does that server have to be a member of the 10.18.7.225/27 subnet where the 
pix is directly connected?  Would something like the following work?

static (inside,outside) 206.x.x.77 10.18.4.142 netmask 255.255.255.255 0 0

and the ACL
access-list acl-outside permit ip any 206.x.x.77 eq 80


If this will work, does anything special need to be configured or will this 
not work at all?  Also, if this does work is there anything particularly bad 
or bad form about this type of arrangement?  Any pointers would be 
appreciated.

Thank you
Scott



More information about the cisco-nsp mailing list