[c-nsp] can you port forward to a non connected subnet?
Scott Granados
gsgranados at comcast.net
Fri Jul 31 14:48:05 EDT 2009
Hi, I have a question RE port forwarding.
BACKGROUND
We have a pix with two interfaces. One public interface has a static
outside of 206.x.x.77 and we have an internal interface with an interface IP
of 10.18.7.254. On the inside interface we attach a core switch with lots
of VLANs with different subnets attached and routing enabled in the switch.
The default route on the core is set to point at 10.18.7.254 and nat is
enabled. One of these VLANS has a subnet of 10.18.4.128/26 which hosts some
servers. The servers are obviously not directly connected to the segment
where the Pix is attached but they can route out to the Internet via the pix
and reach 10.18.7.254 with out issue. My question is can you map a port
from the outside to one of the 10.18.4.128/26 servers through the core or
does that server have to be a member of the 10.18.7.225/27 subnet where the
pix is directly connected? Would something like the following work?
static (inside,outside) 206.x.x.77 10.18.4.142 netmask 255.255.255.255 0 0
and the ACL
access-list acl-outside permit ip any 206.x.x.77 eq 80
If this will work, does anything special need to be configured or will this
not work at all? Also, if this does work is there anything particularly bad
or bad form about this type of arrangement? Any pointers would be
appreciated.
Thank you
Scott
More information about the cisco-nsp
mailing list