5510 Multiple Static IPs with PPPoE 1

[ssjaken]

Hi everyone. I have a cisco 5510 router. The idea is we need to get this one server to be live on the internet with 3 separate IP addresses forwarding to the single address inside. We get to the cloud via PPPoE.

I am using the ASDM 6.3 manager. How would i get the 3 different ip address to become live and accessible with PPPoE. I thought that creating virtual interfaces and giving them static pppoe ip addresses and linking them to the main REAL interface that we would be able to get those live to the cloud. But so far i am unsuccessful.

secondly once the three additional addresses are live, i need to forward them to an internal address. Would it be best to make these rules in the NAT firewall or the ACL.

 

[unclerico]

you should post this on the Cisco ASA forum

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[ssjaken]

could i get a mod to move this for me then? i've been banging my head on this one for about a week and im super lost. any help would be so much appreciated

 

[unclerico]

unfortunately, there are no forum admins here so you'll need to re-post. this is one of many features that the site should have

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[burtsbees]

Actually, you can NAT all inside servers to your outside interface, statically PAT---easiest way without wasting public IPs...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[unclerico]

damnit Burt, now isn't the time for that!!! you're breaking the rules!!!

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[burtsbees]

Ha ha ha ha ha...

"If you don't know me by now...you will never ever ever know me...oooh oo oo oo ooooohhh..."lol

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[ssjaken]

we got a block of 12 ip addresses from our ISP. The guys who wrote the software that runs on this server told me that this stuff needs to be super specific. Kind of a dick lol. 3 external ip's going to the same single ip on our network. Just different ports. SSH SIT PROD and STAGE protocols.

 

[burtsbees]

Well, they can be the same outside IP address simply because the protocol is specified anyway. For example, if I natted ssh (22), http (80) and https (443) all to the same server, to the same outside ip address (22.1.1.2), then each app is handled and sent differently...

PuTTy to ssh, ssh -l root 22.1.1.2
that tells the router, node or whatever is doing ssh to go to that ip address via that port. The ASA then translates that ip address and maps port 22 to the inside ip address.

I want to go to the secure website...

https://12.1.1.2

or say it's natted to port 8080...

https://12.1.1.2:8080

see what I mean? I am not sure the commands in an ASA, but in a Cisco router, it would be

ip nat inside source static tcp 192.168.1.3 80 interface dialer0 80

that NATs the outside interface address (dialer0) to the inside ip address to port 80...port forwarding, or static NAT.

You can do this with one ip address or three public ip addresses---it makes no difference what the ip address(es) is (are), the protocol (layer 4) still needs to be specified when making the connection. Now lemme Google real quick...brb...

Crap...here's how to do it with ASDM...

http://www.cisco.com/en/US/docs/security/asa/asa72/getting_started/asa5550/quick/guide/dmz_n.html

OK---apparently it's a static statement...

static (inside,outside3) 12.1.1.3 192.168.1.3 netmask 255.255.255.255

that example is naming one of the interfaces "outside3". I think you can specify the port/protocol after the ip address...

static (inside,outside) 12.1.1.2 ssh 192.168.1.2 netmask 255.255.255.255

but again, the protocol would not matter in this case since each inside host has it's own outside address for translation, and the protocol gets specified by the sender.

@@@@@@@@@@@@@@@@@@@@@@---OR---@@@@@@@@@@@@@@@@@@@@@

You can just create a DMZ with the three ip addresses and not NAT anything.

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[ssjaken]

thanks burt. i think just putting the server on the DMZ might be the most painless option. The guy who wrote the software was super specific on the firewall specifications. Its a record management server where people from all over the state go and....put records in hah.

another, how can i get the extra static IP's to authenticate on the internet. I cannot for the life of me figure out how to get these extra addresses to work.