NAT based on destination port number

Question

Is it possible to translate one local source IP address to different glabal addresses, with translation being based on destination port number?

Cisco 3825 and PIX 501 are available.

Within a concrete task, I need to send HTTPS requests from my client program to an outside web server, periodically changing a global address used by the program.

I have got a pool of 64 internet addresses.

I can change sent packets destination port number programmatically, and I hope to use these changed port numbers as a criterion when translating the source IP address.

I am about to revert the destination port number back to 443 after changing the global source IP address.

Answer 1

From a support forum static-pat-pix

Note: You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.

Thus it seems we have two options:

• NAT on the router; not recommended as it would be difficult to get through the PIX.

• Change the IP address (private) on the host, and have a PIX rule for each private IP address.

As you did not give any real IP addresses, I will create a example.

• On the hosts, use 10.0.0.1-10.0.0.15/28.

• On the PIX, NAT to 196.0.0.1 - 196.0.0.1

  global (outside) 1 196.0.0.1-196.0.0.15 netmask 255.255.255.240
  nat (inside) 1  10.0.0.0  255.255.255.240  0  0
  

Or you can NAT, one by one, with:

static (inside,outside) 10.0.0.1 196.0.0.1 netmask  255.255.255.255
static (inside,outside) 10.0.0.2 196.0.0.2 netmask  255.255.255.255

etc.

Now, every time you need to change your external IP address, just change the internal source IP address.

Answer 2

You can do this with Cisco EEM. If you had IOS-XE, there is an XML API - but you don't. EEM should work though. See cron timer.

Cisco IOS Embedded Event Manager (EEM) is a powerful tool integrated with Cisco IOS Software for system management from within the device itself. EEM offers the ability to monitor events and take informational, corrective, or any desired action when the monitored events occur or when a threshold is reached. Capturing the state of the router during such situations can be invaluable in taking immediate recovery actions and gathering information to perform root-cause analysis. Network availability is also improved if automatic recovery actions are performed without the need to fully reboot the routing device. EEM consists of three main components: EEM server, event publisher, and event Subscriber (policies).