3

Is it possible to translate one local source IP address to different glabal addresses, with translation being based on destination port number?

Cisco 3825 and PIX 501 are available.

Within a concrete task, I need to send HTTPS requests from my client program to an outside web server, periodically changing a global address used by the program.

I have got a pool of 64 internet addresses.

I can change sent packets destination port number programmatically, and I hope to use these changed port numbers as a criterion when translating the source IP address.

I am about to revert the destination port number back to 443 after changing the global source IP address.

Improve this question
2
  • Is the router behind or in front of the pix ? Which one is currently doing NAT? And do I understand correctly that you want to configure the router or the pix (no preference?) in such a way that when x.x.x.x (on the inside) connects to y.y.y.y (on the internet) on port 1234 then x.x.x.x gets translated to z.z.z.z2 and 1234 gets translated to 443? And if same x.x.x.x connects to y.y.y.y:6789 then x.x.x.x needs to translate to z.z.z.z3 and 6789 also to 443? etc.?
    – hertitu
    Sep 2, 2016 at 8:18
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 18:36

2 Answers 2

Reset to default
2

From a support forum static-pat-pix

Note: You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.

Thus it seems we have two options:

  • NAT on the router; not recommended as it would be difficult to get through the PIX.

  • Change the IP address (private) on the host, and have a PIX rule for each private IP address.

As you did not give any real IP addresses, I will create a example.

  • On the hosts, use 10.0.0.1-10.0.0.15/28.

  • On the PIX, NAT to 196.0.0.1 - 196.0.0.1

    global (outside) 1 196.0.0.1-196.0.0.15 netmask 255.255.255.240
nat (inside) 1  10.0.0.0  255.255.255.240  0  0

Or you can NAT, one by one, with:

static (inside,outside) 10.0.0.1 196.0.0.1 netmask  255.255.255.255
static (inside,outside) 10.0.0.2 196.0.0.2 netmask  255.255.255.255

etc.

Now, every time you need to change your external IP address, just change the internal source IP address.

Improve this answer
1
  • In Pix static command the global ip comes first, so this should be static (inside,outside) 196.0.0.1 10.0.0.1 netmask 255.255.255.255
    – hertitu
    Sep 2, 2016 at 12:13
1

You can do this with Cisco EEM. If you had IOS-XE, there is an XML API - but you don't. EEM should work though. See cron timer.

Cisco IOS Embedded Event Manager (EEM) is a powerful tool integrated with Cisco IOS Software for system management from within the device itself. EEM offers the ability to monitor events and take informational, corrective, or any desired action when the monitored events occur or when a threshold is reached. Capturing the state of the router during such situations can be invaluable in taking immediate recovery actions and gathering information to perform root-cause analysis. Network availability is also improved if automatic recovery actions are performed without the need to fully reboot the routing device. EEM consists of three main components: EEM server, event publisher, and event Subscriber (policies).

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.