Assigning Multiple Public IP Addresses via Cisco Router

[mRgEE]

Hi,

I already have one public ip address that is being used to host my http (external facing website), https (Outlook Web Access) and smtp (Exchange Server) traffic to internal services. Now I have the need to provide access to another https service (Citrix Secure Gateway) on a different server. I have 2 public IP addresses assigned to me from my ISP. My internal subnet is 10.0.0.0 255.0.0.0.

Question is, how do I configure my router to use both public IP addresses and forward the different https traffic to the different internal servers? My current router is a netgear which only allows 1 public IP address to be assigned to it. I plan to replace the Netgear with my Cisco 2600 router if it is indeed capable of acheiving this config.

 

[gwildfire]

you netgear would be able to do this using port forwading, you can only host one thing on one port but PAT should be fine.

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[mRgEE]

I already have port forwarding set for https port 443 forwarding internally to 10.0.0.10 for Outlook Web Access. I now have another https secure site on my 10.0.0.86 server (for citrix secure gateway) that I need to be able to send https traffic to. So when the https (port 443) traffic hits my router / firewall any https traffic is automatically directed to 10.0.0.10 - there is no way to differentiate the different https traffic as far as I can see other than utilize another public IP address.

If you know another way please explain

 

[mRgEE]

I have been thinking about this issue for some time now and wonder if an extended access list may be the solutuon I am looking for?

For example...

I assign my first public IP address to the Internet interface, then create a subinterface on the Internet interface and assign my second public IP address to this.

Then with an extended ACL I could use the following statements to allow traffic inbound to both servers that need to allow https: -

access-list 101 permit tcp any host 10.0.0.1 eq https
access-list 101 permit tcp any host 10.0.0.86 eq https
access-list 101 deny ip any any

Would this work?

 

[ptdog]

You are going to need static nat. assign the interface one public ip address, then use natting and access to achieve what you need to do with the second ip address.

 

[v3user]

you can add multiple IPs to your outside(internet) interface without having to create subinterfaces
example:
interface Ethernet3
ip address 172.68.1.100 255.255.255.0
ip address 172.68.1.101 255.255.255.0 secondary
ip address 172.68.1.102 255.255.255.0 secondary
ip nat outside

Then you can create a static map and map the public IP with one of your private IPs

Look here for examples

Hope this helps

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080093f2f.shtml