How to point 1 Public IP to multiple ips in DMZ

[zamriyusoff]

Hi,
FYI, I'm neither a network guy nor System Administrator but I having this problem.
My Servers are behind PIX Firewall. I have 1 public IP that is referred by a few Domain Names. The question is, how to do the translation in the PIX Firewall so that if request coming from a particular domain name will be redirected to the specific server for that name only.

May be the illustrastion below may help;

let say domain

http://www.abc.com,

mail.abc.com, me.abc.com are pointing to the same public Ip (202.188.0.x).
In the PIX Firewall, I need to translate each connection to respective server, for eaxmple;
- any request for

http://www.abc.com

will point to server with IP 172.16.0.1
- Request from mail.abc.com will point to another server with ip address 172.16.0.2
- Request from me.abc.com will point to a server with ip address of 172.16.0.1 at port 8181

Any feedback are welcomed.

Thanks and Best Regards,
Zamri

 

[dopehead]

You can't. You could however choose one server to use for redirecting to the other sites, but it will never be quite as usefull as having all sites on the same server or cluster servers.

Network Systems Engineer
CCNA/CQS/CCSP/Infosec
Check the danish Cisco CSA Forum here :

http://www.csaforum.dk

 

[vlf]

The problem is that the information about the HTTP site is in the layer 4+ headers. Neither a PIX nor a router have the ability to look into those headers - they only look at layers 1-3.

You could put an appliance in front of your PIX, such as a Cisco 11000 or a F5 device that can look at the layer 4+ header information, and then use NAT to send the packets to different servers.

I wouldn't put a server in front of my PIX because they're much more vulnerable than appliances. Mind you appliances are still vulnerable, just not as much so.

If your servers are on different DMZs, I also wouldn't necessarily do the redirecting after the PIX. If you did that, traffic going to IP1 would go through the PIX to the first dmz where the appliance/server was. This device would determine which server is the ultimate destination, and NAT the destination IP address and send the traffic back out. If that server is on a separate DMZ, it will have to go back through the PIX to the destination DMZ. The server then processes the data, sends it back through the PIX to the DMZ where the server/appliance is where it NATs it back and then sends it back through the PIX to the requestor. That's a lot of rather unnecessary trips through the PIX.

 

[zamriyusoff]

OK guy, thanks for the feedback. I will find another workaround for this.

Rgds,
Zamri