Pix - ISA Help

Nov 09, 2006 3 Replies
C

We recently added a ISA server to our network. We didn't want to replace the Pix but did want the functionality of publishing our internal websites through the ISA appliance.



Currently I have it setting in our DMZ which is a 192.168.1.x private address space. But I am limited due to NAT to pass more than 1 of our external web server address to the ISA applicance.



We want to be able to have anyone accessing our web servers (several on inside network) from the outside to go through the pix and then the ISA box.



Is there away to have the PIX pass this traffic to the ISA box with requiring NAT? So the ISA will due the NAT. I am running into a double NAT issue currently.



Or will I need to change the design to a back to back or parallel configuration?



If you can provide examples of the commands and IP setup that would help alot.



Thanks



Vote
Twitter Facebook LinkedIn
A

Hi,

I would think no-nat the traffic on the PIX and let ISA do the NAT and publish the website pointing to the webservers inside the netowrk.

-Aman

snipped-for-privacy@cox.net wrote:

Vote
Twitter Facebook LinkedIn
C

Thanks for the reply. Could you provide the commands to accomplish this. I am running Pix code 7.0.6.

That sounds exactly like what I need to do.

Thank You.

ajs> Hi,

Vote
Twitter Facebook LinkedIn
A

Hi,

Below is an example on how would you do a nonat on the pix:

access-list nonat extended permit ip any x.x.x.x y.y.y.y nat (outside) 0 access-list nonat static (dmz,outside) tcp x.x.x.x www z.z.z.z www netmask

255.255.255.255

I h> Thanks for the reply. Could you provide the commands to accomplish

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required