Reconfigure existing 506

[Javamahn]

Current configuration is set so all inbound connections are sent to single machine. We are spilting up the web and email so I need to redirect all inbound

http://www to

machine 10.1.1.25 and all inbound mail to 10.1.1.5 I also allow all outbound traffic to NAT: Can someone help me rewrite the following config.
----------------------------------------------------------

global (outside) 1 200.240.10.88
nat (inside) 1 10.1.1.0 255.255.255.0 0 0
static (inside,outside) 200.240.10.86 10.1.1.5 netmask 255.255.255.255 0 0
conduit permit tcp host 200.240.10.86 eq smtp any
conduit permit tcp host 200.240.10.86 eq

http://www any

conduit permit tcp host 200.240.10.86 eq pop3 any

----------------------------------------------------------
I tried rewriting the static to the following
static (inside,outside) tcp 200.240.10.86

http://www 10.1.1.25

http://www netmask

225.255.255.255 0 0
static (inside,outside) tcp 200.240.10.86 smtp 10.1.1.5 smtp netmask 225.255.255.255 0 0

The inbound traffic still went to the old server. ARP cache? I also notice cisco references a nat command
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
How is this different from my Nat command?

I Graciously thank anyone who can help me.
Steve Anderson

 

[yizhar]

HI.

What is the pix OS version?
How many registered ip addresses do you have to play with?
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Javamahn]

The OS is latest 6.2. I have 3 registered Ip addresses. Currently all DNS resolves to the external address 200.240.10.86 the external interface has .84 and I have .85 unused.

 

[yizhar]

HI.

The best solution in my opinion is to use the .85 address for one of the servers, and configure DNS as needed.
If you are worried about DNS propagation times, you can ask your ISP to first lower the TTL for your DNS zone, then the day after make the changes so they will be implemented faster, and restore the original TTL.
You should also ask your ISP (or who that manages your DNS zone) to update the PTR record for the changes.

About the pix config, it is simple and basic, assuming that you change only the address of web server:

static (inside,outside) 200.240.10.85 10.1.1.25
no conduit permit tcp host 200.240.10.86 eq

http://www any

conduit permit tcp host 200.240.10.85 eq

http://www any

But, if you're using OS 6.21 and PDM 2.02, then I suggest upgrading your configuration to access-list instead of conduit to be more compatible and uptodate.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Javamahn]

Is it possible to redirect using only the one registered IP address? Although I know the way to do it would be to redirect static ouside to inside seperately I would like to know if it is possible to use only one external address.

Thank you

 

[Javamahn]

I realized only after viewing my xlate table that my above static commands had never taken place. after a clear xlate the above command works to Port Redirect the incoming traffic to the proper machines.

Thanks for the help