Redirecting ports on a CSS

How can I redirect a tcp/udp port through a CSS ??? I have an application running on VLAN2 and it needs to connect to a server running on VLAN3. This application first go to a vip address in the CSS, and this vip is balancing the service across TCP port 1352 in a Raptor Fw. The log in the Raptor said "Non-transparent call from x.x.x.x" ... Any susggestion ???

If you're only doing firewall loadbalancing, the CSS is not going to NAT the traffic or change any port.
Your firewalls should be doing this.
If you also have a VIP defined with services, each service representing a server, you can configure different port for each one of them.
If you still need more help, please give us an example of traffic flow with traffic before and after the CSS and what you expect to see.
Gilles.

Similar Messages

Redirect port help

I am to try to redirect port 3500 of dialer0 for an IP 192.168.1.2 in the Lan whit the same port number. Already I moved in nat. E I created rules ACL. But I did not obtain.
Router cisco 836
My config:
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname cisco5000
boot-start-marker
boot-end-marker
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
ip subnet-zero
ip name-server xxx.xxx.xxx.xxx
ip name-server xxx.xxx.xxx.xxx
ip cef
ip ips po max-events 100
vpdn enable
l2tp-class PTRP-L2TP
authentication
hello 50
password 7 xx
exit
pseudowire-class PTRP-PWC
encapsulation l2tpv2
protocol l2tpv2 PTRP-L2TP
ip local interface Dialer1
exit
no ftp-server write-enable
interface Ethernet0
description == LAN =
ip address 192.168.1.15 255.255.255.0
ip directed-broadcast
no ip proxy-arp
no ip mroute-cache
no keepalive
no cdp enable
exit
interface BRI0
no ip address
no cdp enable
exit
interface ATM0
no ip address
load-interval 30
no atm ilmi-keepalive
dsl operating-mode auto
exit
interface ATM0.1 point-to-point
pvc 0/35
encapsulation aal5snap
protocol ppp dialer
dialer pool-member 1
exit
interface FastEthernet1
no ip address
duplex auto
speed auto
exit
interface FastEthernet2
no ip address
duplex auto
speed auto
exit
interface FastEthernet3
no ip address
duplex auto
speed auto
exit
interface FastEthernet4
no ip address
duplex auto
speed auto
exit
interface Virtual-PPP1
description == Tunel L2TP BE-BT1 ==
ip address negotiated
backup delay 30 30
backup interface Virtual-PPP2
no cdp enable
ppp pap sent-username xx
pseudowire xxx.xxx.xxx.xxx pw-class PTRP-PWC
exit
interface Virtual-PPP2
description == Tunel L2TP BE ==
ip address negotiated
no cdp enable
ppp pap sent-username xx
pseudowire xxx.xxx.xxx.xxx 10 pw-class PTRP-PWC
exit
interface Dialer1
description == ADSL ==
ip address negotiated
ip access-group 111 in
no ip unreachables
encapsulation ppp
no ip route-cache cef
no ip route-cache
no ip mroute-cache
dialer pool 1
dialer remote-name xx
dialer idle-timeout 0
dialer-group 1
ppp pap sent-username xx
exit
ip classless
ip route 0.0.0.0 0.0.0.0 Virtual-PPP1 10
ip route 0.0.0.0 0.0.0.0 Virtual-PPP2 100
ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer1
ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer1
ip http server
ip http authentication local
ip http secure-server
access-list 7 remark === Remote CONF ===
access-list 7 permit xxx.xxx.xxx.xxx
access-list 7 permit xxx.xxx.xxx.xxx
access-list 111 remark === internet ===
access-list 111 permit ip host xxx.xxx.xxx.xxx any
access-list 111 permit ip host xxx.xxx.xxx.xxx any
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any time-exceeded
access-list 111 permit ip host xxx.xxx.xxx.xxx any
access-list 111 permit ip host xxx.xxx.xxx.xxx any
access-list 111 deny ip any any
dialer-list 1 protocol ip permit
no cdp run
control-plane
exit
line con 0
no modem enable
transport preferred all
transport output all
stopbits 1
exit
line aux 0
transport preferred all
transport output all
exit
line vty 0 4
access-class 7 in
transport preferred all
transport input all
transport output all
exit
scheduler max-task-time 5000
scheduler interval 500
exit
end

content WEB_80
vip address 10.1.18.11
add service 1
protocol tcp
add service 2
port 80
advanced-balance sticky-srcip
active
In this example the request will come in through port 80, but for it to go out by port 3500 we can add the following command port xxxx (where xxxx is the number of the port) in a service. This will allow the CSS to redirect the request to the server on the desired port.
This is just an example to let you see how and where to configurate it.

How can I add a redirect port, or RPT port, in Windows 7?

I'm dumbfounded. I know in Windows XP there was an option to add a printer and select the redirection port. Seems in Windows 7, or at least my installation, that option is missing. I need to be able to add a redirect port to setup some
specialized printing we do here in our office. Hope my question makes sense and I hope I have just missed something and it's really just not that it's not possible or I'm screwed!
Also I have tried the "Add New Port Type" options and it asks for a driver which I can't seems to find anywhere. Any help is much appreciated as this has halted my Windows 7 roll out.

Hi,
Do you mean in Windows XP, we can add a new port in File-> Server Properties-> Ports-> Add Ports?
If this is the issue, please see the information below:
====================================
In Windows 7, we have no Server Properties options. But we can also achieve the same goal by using the following two methods:
Method 1: Right click one of the local printers and select Printer Properties. Click Ports-> Add Port…
Method 2: In Control Panel, click Administrative Tool and select Print Management. Then open Print Servers and select the local machine. Then right click Ports and
click Add Ports…
Hope this can have a little help.
Best regards,
Spencer Shi
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Redirect Port 80

I know this is a very basic question but how do you redirect port 80? I have an option to port forward or port trigger.
What I am trying to do is use a program called Remote Administrator. It works locally on my network but as soon as I try to connect from outside the network it fails. I suspect port 80 is the issue and no matter what I do it still comes up as stealth on the GRC site. So, I port forwarded 80 (both TCP & UDP) to my local ip address that I want to connect to and no go.
Am I missing some hidden place in the router config that has redirect...
Thanks in advance

I agree with you but someone mislead me to believe that port 80 was the problem. I have port forwarded 4899 to my internal IP and it still does not connect. I have tried using a no-ip program called canyouseemee to verify if the port is open but it appears to be closed. I can connect locally but not over the internet so I assume it's a router/firewall issue.
Any ideas?

Redirect port 80 to 8080

Hey I have created a simple http server, so when i type
> curl http://localhost:8080/
I give me the respons:
> Hello World
now i want the same to happen when I type:
> curl http://localhost:80/
I could do that by changen the port that the http server is lisining on but it will require that i run it as a super user and i don't want that.
I have tryed to use the ipfw command (I have vey limited knowleged about it):
> ipfw add 100 fwd 127.0.0.1,8800 tcp from any to any 80 in
it then says:
> 00100 fwd 127.0.0.1,8800 tcp from any to any dst-port 80 in
I look at the list:
> ipfw -d -e -t -a list
it says:
> 00100 1 64 Thu Aug 4 14:47:51 2011 fwd 127.0.0.1,8800 tcp from any to any dst-port 80 in
> 65535 188 33853 Thu Aug 4 14:45:39 2011 allow ip from any to any
But when i try to get a respons from my http server:
> curl http://localhost:80/
It says:
> curl: (7) couldn't connect to host
I try to restart my computer and check the list again:
> ipfw -d -e -t -a list
It says:
> 65535 464 111936 Thu Aug 4 14:48:39 2011 allow ip from any to any
So somehow the rule has been removed.
What can i do to redirect port 80 to 8080,

I should have writen
sudo ipfw add 100 fwd 127.0.0.1,8080 tcp from any to me 80
I belive the important diffrent is the change from any to me in the last part.
And rules applyed to ipfw will be rested after restarting,

Redirect port 80 in a zone to port 8070 in a zone - IPFILTER/IPNAT

I have a non-root user running a web server on 8070 in a zone, and he wants port 80 redirected to 8070 so his URL wont have :8070 in it.
On Linux with iptables, I did:
iptables -t nat -I PREROUTING -p tcp dport 80 -j REDIRECT to-ports 8070
Works great, all traffic to port 80 is redirected to port 8070.
How can I do the same with IP Filter? I understand IP Filter has to be run in the global zone, not a problem.

DBSanders, I have a similar configuration on my research network.
I wanted all web traffic coming to the bastion host (stargate) to be routed to 443 on my webserver (prometheus);
dmfe0 is the internal adapter, and dmfe1 is the external adapter.
So, my solution looks like this:
stargate:/etc/ipf/ipf.conf:
pass in quick on dmfe1 from any to any port=80 keep state
pass in quick on dmfe1 from any to any port=8080 keep state
pass in quick on dmfe1 from any to any port=443 keep state
pass out quick from prometheus port=443 to any keep statestargate:/etc/ipf/ipnat.conf:
rdr dmfe1 stargate port 80 -> prometheus port 443 tcp
rdr dmfe1 stargate port 443 -> prometheus port 443 tcp
rdr dmfe1 stargate port 8080 -> prometheus port 443 tcp

HTTPS redirect from server on CSS 11501

Hi,
I make HTTPS request to server via CSS and now my question is can i get the response from the server in HTTP mode due to redirect function. I want to put it in HTTPS is this possible???
Regards
Sara

Are you offloading SSL on CSS and sending clear traffic to servers and servers and sending back redirects using http? If thats the issue and you want clients to get redirects with https Use urlrewrite feature on CSS
details at
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.10/configuration/ssl/guide/terminat.html#wp999332
Syed Iftekhar Ahmed

Redirect code to different css file for mobiles

i need some code that i can use to detect mobiles and then change to a css file for the page so it looks good on mobiles. ive been looking around and i can only find redirect codes to mobile versions on websites and i dont want that, i want to stay on the same page but just use a different css file. Thanks to anyone that can help me.

What you want are CSS Media Queries. They can be incorporated into your main CSS file like so. Feel free to adjust breakpoint values as required.
/* Special Styles for Mobiles. */
@media only screen and (max-width: 480px) {
    body { font-size: 75% }
/* Special Styles for Tablets */
@media only screen and (min-width: 481px) {
     body { font-size: 100%; }
/* Special Styles for Desktops */
@media only screen and (min-width: 1025px) {
     body { font-size: 135%; }
Nancy O.

Redirecting Port 80 to 8080

Hello,
Below is my configuration for redirecting http://apps.domain.local to http://apps.domain.local:8080. Please let me know if I am on the right track.
Thanks,
rserver redirect REDIRECT_TO_8080
description SAP BO Redirect RServer from 80 to 8080
webhost-redirection http://%h%p:8080 301
inservice
serverfarm redirect SF_REDIRECT_8080
description SAP BO Redirect RServer from 80 to 8080
rserver REDIRECT_TO_8080
inservice
class-map match-all VIP_SAP_BO_8080
2 match virtual-address 10.1.0.99 tcp eq 8080
class-map match-all VIP_SAP_BO_80
2 match virtual-address 10.1.0.99 tcp eq 80
policy-map type loadbalance first-match PM_REDIRECT_8080
class class-default
serverfarm SF_REDIRECT_8080
policy-map type loadbalance first-match PM_LB_SAP_BO
description Load Balance Policy for SAP Business Objects
class class-default
sticky-serverfarm IP_STICKY_SAP_BO
policy-map multi-match PM_MULTI_MATCH_LB
description Load Balancing Service Policy 1
class VIP_VIP_SAP_BO_80
loadbalance vip inservice
loadbalance policy PM_REDIRECT_8080
loadbalance vip icmp-reply active
class VIP_SAP_BO_8080
loadbalance vip inservice
loadbalance policy PM_LB_SAP_BO
loadbalance vip icmp-reply active

Hello,
I have the similar requirement and i have tried unsuccessfully to achieve it, will appreciate your help on it. Below is the scenario, ace loadbalances request recieved on port 8080 but when ace receives the request on port 80, iam unable to redirect to port 8080. Please let me know mistake in this configuration as it doesnt seems to work.
And the configuration is as follows:
access-list permitany line 8 extended permit ip any any
access-list permitany line 9 extended permit icmp any any
access-list permitany line 10 extended permit tcp any any
probe tcp CONTENT-PROBE-SERVERS-8080
port 8080
interval 30
passdetect interval 10
open 1
rserver host CONTENT-SERVER-1
ip address 192.168.3.130
inservice
rserver host CONTENT-SERVER-2
ip address 192.168.3.140
inservice
serverfarm host CONTENT-SERVERS-8080
probe CONTENT-PROBE-SERVERS-8080
rserver CONTENT-SERVER-1 8080
    inservice
rserver CONTENT-SERVER-2 8080
    inservice
sticky ip-netmask 255.255.255.255 address source STICKY-CONTENT-SERVERS-8080
timeout 120
replicate sticky
serverfarm CONTENT-SERVERS-8080
class-map match-any CMAP-CONTENT-SERVERS-8080
2 match virtual-address 192.168.3.145 tcp eq 8080
class-map match-any CMAP-WEB-SERVERS-80
2 match virtual-address 192.168.3.145 tcp eq www
class-map type management match-any remote_access
2 match protocol xml-https any
3 match protocol icmp any
4 match protocol telnet any
5 match protocol ssh any
6 match protocol http any
7 match protocol https any
8 match protocol snmp any
policy-map type management first-match MANAGEMENT-ACCESS
class remote_access
    permit
policy-map type loadbalance first-match PMAP-CONTENT-SERVERS-8080
class class-default
    sticky-serverfarm STICKY-CONTENT-SERVERS-8080
policy-map type loadbalance first-match PMAP-WEB-SERVERS-80
class class-default
    sticky-serverfarm STICKY-CONTENT-SERVERS-8080
policy-map multi-match NLB-SERVERS
class CMAP-WEB-SERVERS-80
    loadbalance vip inservice
    loadbalance policy PMAP-WEB-SERVERS-80
    loadbalance vip icmp-reply
class CMAP-CONTENT-SERVERS-8080
    loadbalance vip inservice
    loadbalance policy PMAP-CONTENT-SERVERS-8080
    loadbalance vip icmp-reply
    nat dynamic 1000 vlan 113
interface vlan 113
description **** CLIENT VLAN ****
bridge-group 1
mac-sticky enable
no icmp-guard
access-group input NONIP
access-group input permitany
access-group output permitany
nat-pool 1000 192.168.3.145 192.168.3.145 netmask 255.255.255.255 pat
service-policy input MANAGEMENT-ACCESS
service-policy input NLB-SERVERS
no shutdown
interface vlan 500
description **** SERVER VLAN ****
bridge-group 1
access-group input NONIP
access-group input permitany
access-group output permitany
service-policy input MANAGEMENT-ACCESS
no shutdown
interface bvi 1
ip address 192.168.3.234 255.255.255.0
alias 192.168.3.236 255.255.255.0
peer ip address 192.168.3.235 255.255.255.0
no shutdown

SSL Redirect Port ?

Hello All,
Im a litle confuse, and im not getting there.
I had this config scheme, and it works fine:
Every SSL Traffic is ended in SSL Module, and give it back to content as port 80.
It matchs the content HTTP-Aplj, and sends traffic to service esl0011-7777.
It works fine, with http and https.
Then i had tryed many unsucessefully times the following:
I want that http traffic goes just like the actual config, ending on backend servers on port 7777, but want the https traffic to be redirected to 4443.
I have done some trys on several parts of the configs, adding new services for 4443 port, ssl-proxy-list, and adding a new content.
I even got this message, when was trying to active the content SSL.Aplj:
%% Not all content VIP:Port combinations are configured in a ssl-proxy-list for sslAccel type of services
Please give me some ideias to achieve this goal.
The following config is the basic config for the 1st step. The working one.
Best Regards,
Bruno PetrÃ³nio
************** SSL-Proxy-List **************
ssl-server 90 vip address 10.1.2.136
ssl-server 90 urlrewrite 1 https:\\10.1.2.136
ssl-server 90 rsacert xxxxcert
ssl-server 90 rsakey xxxxkey
ssl-server 90 cipher rsa-export-with-rc4-40-md5 10.1.2.136 80
************** SERVICE **************
service MODSSL
slot 2
type ssl-accel
keepalive type none
add ssl-proxy-list ssl1
active
service esl0011-7777
ip address 10.1.1.120
port 7777
keepalive type http
keepalive port 7777
keepalive uri "/"
active
************** OWNER **************
owner Test
content HTTP-Aplj
vip address 10.1.2.136
port 80
protocol tcp
add service esl0011-7777
redundancy-l4-stateless
active
content SSL-Aplj
vip address 10.1.2.136
add service MODSSL
application ssl
advanced-balance ssl
protocol tcp
port 443
url "/*"
redundancy-l4-stateless
active

try the following
ssl-server 90 vip address 10.1.2.136
ssl-server 90 urlrewrite 1 10.1.2.136
ssl-server 90 rsacert xxxxcert
ssl-server 90 rsakey xxxxkey
ssl-server 90 cipher rsa-export-with-rc4-40-md5 10.1.2.136 4443
service esl0011-4443
ip address 10.1.1.120
port 4443
keepalive type http
keepalive uri "/"
active
content HTTP-4443
vip address 10.1.2.136
port 4443
protocol tcp
add service esl0011-4443
active
BTW, I also corrected your urlrewrite command as it was incorrect. You need to specify the host. So not http or https in front.
Gilles.

CSS 80 to 443 redirect with wildcard

Hello,
I am doing a 80 to 443 redirect on a 11503 CSS and would like to know if I can do a "wildcard" redirect for after the / ? For example:
I currently have this
content test-redirect
    vip address 10.10.10.10
    redirect "https://test.domain.com"
    protocol tcp
    port 80
    url "/*"
    active
Can I use this?
content test-redirect
    vip address 10.10.10.10
    redirect "https://test.domain.com/*" <- use the wildcard *
    protocol tcp
    port 80
    url "/*"
    active
Thanks,
Dave

Adding the asterisk, would not do what you want.
The CSS is not going to replace the asterisk with the path introduced by the user.
Here are all the methods to do a redirect on the css.
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a00801de8d6.shtml
Try to use the solution with the domain command.
This should only replace the domain and leave the path unchanged.
Gilles.

Management port on CSS 11150

I have a simple question. Can someone tell me how to access the management port on the css 11150?
I configured the ip and mask on the management port and condigured my laptop for a ip on the same network. But i am unable to connect.

what do you mean by connect ?
Are you trying telnet or HTTP ?
Are you able to ping ?
Is the interface showing up ?
Try 10Mb Half duplex set manually and see if it works.
Also, did you reboot the CSS after configuring the ip address/mask for the management interface ?
Gilles.

Will there be any problem if CSS reuses a TCP PORT number?

Will there be any problem if CSS reuses a TCP PORT number for a new flow a few minutes after it finished a flow with the same TCP Port number.
CSS Server inititaed connection to Internet.
Sometimes a TCP RST terminates the connection. When it happens it appears that the CSS has used a TCP source port number which is sthe same as a previous flow that FIN'ed a few minutes ago. See attachment.

My answer to your question is, I think you'll be 'less likely'. Although the screen proble has also been reported to create blue tints over the screen at certain angles, thus, if you do get a defective (yet to be confirmed) device, then sadly, it will most definatley affect the colours of a cartoon show.

CSS Gig/Cu port to Cat4k FastEthernet

In our lab I'm trying to get a CSS11503 with Gig over coper ports (SCM-2GE) to talk to a cat 4k fast ethernet port via cat5 straight-through. But no luck. Do those ports speak only with other Gig over copper switch ports? Or is there a way to get it to talk to the cat4k's fastethernet ports? Thanks.
Here is the output from phy? Notice that the 100 Mbits settings are only allowed for 10/100 ports. Also the AUTO setting will not work for these Gig over copper ports.
CSS11503(config-if[ 1/1])# phy ?
100Mbits-FD 10/100 ports only. Set to 100 Mbits/s, Full-Duplex
100Mbits-HD 10/100 ports only. Set to 100 Mbits/s, Half-Duplex
10Mbits-FD 10/100 ports only. Set to 10 Mbits/s, Full-Duplex
10Mbits-HD 10/100 ports only. Set to 10 Mbits/s, Half-Duplex
1Gbits-FD-asym Gigabit ports only. Set to Full duplex with asymmetric
pause toward link partner
1Gbits-FD-no-pause Gigabit ports only. Set to Full duplex with no pause
1Gbits-FD-sym Gigabit ports only. Set to Full duplex with symmetric
pause
1Gbits-FD-sym-asym Gigabit ports only. Set to Full duplex with symmetric and
asymmetric pause toward local device
auto-negotiate Allow the interface to auto-negotiate speed and duplex
mode.
CSS11503(config-if[ 1/1])# phy auto
%% That syntax is only for 10/100 interfaces

Thanks. But no - I had already tried a cross-over cable and this did not solve the issue. I eventually located a GigE blade for the Cat4k and *that* is the issue. The gig ports on a CSS are (surprisingly) not compatible with Fast Ethernet ports. I say surprisingly as every workstation I've bought for the last 3-4 years that has had a 10/100/1000 card as worked fine with fast ethernet. Seems like Cisco went out of its way to make CSS Gig ports not compatible. Maybe to force upgrading! Can't figure WHY they would select an interface incompatible with Fast Ethernet. Maybe their marketing team was in on that as a way to spur cheap customers to more expensive switches.
BTW - it was a straight-through cable from the CSS to the Gig port on the Catalyst that brought link light.

DesktopApp auto update URL port redirection.

Hi Everyone,
We are using Filr-1.0.1-HP1 and we are using the port-redirection option to redirect port 80 & 443 to 8080 & 8443 respectively. However this port-redirection doesn't seem to work for the auto update URL. I would rather not open the port 8443 on the firewall. Am i missing some configuration option somewhere?
https://<baseurl>/Desktopapp
invalid URL
https://<baseurl>:8443/Desktopapp
OK
Kind Regards,
Justin Zandbergen
edit: typo's

Originally Posted by thsundel
Justin, take a look here: https://forums.novell.com/showthread...67#post2295867
Tomas
Hi Thomas,
Thanks for the advice, i knew that was an option, but i would have preferred to stick it on filr.<customer>.nl/desktopapp instead of something.<customer>.nl/desktopapp. Ah well, it works now. Thanks!
Kind Regards,
Justin Zandbergen

Redirecting ports on a CSS

Similar Messages

Maybe you are looking for