Static NAT to two servers using same port

I have a small office network with a single public IP address. Currently we have a static nat for port 443 for the VPN. We just received new software that requires the server the software is on to be listening on port 443 across the internet. Thus, essentially I need to do natting (port forwarding) using port 443 to two different servers.
I believe that the usual way to accomplish this would be to have the second natting use a different public facing port, natted to 443 on the inside of the network (like using port 80 and 8080 for http). But, if the software company says that it must use port 443, is there any other way to go about this? If, for example, I know the IP address that the remote server will be connecting to our local server on, is there any way to add the source IP address into the rule? Could it work like, any port 443 traffic also from x.x.x.x, forward to local machine 192.168.0.2. Forward all other port 443 traffic not from x.x.x.x to 192.168.0.3.
Any help would be very much appreciated.
Thanks,
- Mike

Hi,
Using the same public/mapped port on software levels 8.2 and below would be impossible. Only one rule could apply. I think the Cisco FWSM accepts the second command while the ASA to my understanding simply rejects the second "static" statement with ERROR messages.
On the software levels 8.3 and above you have a chance to build a rule for the same public/mapped port WHEN you know where the connections to the other overlapping public/mapped port is coming from. This usually is not the case for public services but in your situation I gather you know the source address where connections to this server are going to come from?
I have not used this in production and would not wish to do so. I have only done a simple test in the past for a CSC user. I tested mapping port TCP/5900 for VNC twice while defining the source addresses the connections would be coming from in the "nat" configuration (8.4 software) and it seemed to work. I am not all that certain is this a stable solution. I would imagine it could not be recomended for a production environment setup.
But nevertheless its a possibility.
So you would need the newer software on your firewall but I am not sure what devce you are using and what software its using.
- Jouni

Similar Messages

How to set up NAT for two servers using same port with ASDM ASA 5505

Hi there,
We have a new installation of a ASA 5505 and are trying to get some NAT issues straightened out. Here is the scenario: On our internal network, we have two servers running Filemaker Server, a relational database server that clients connect with using port 5003. Our goal is to be able to allow users from the outside to access either of these servers as needed. I know how to set up a simple static NAT rule and matching Access rule in ASDM which would be fine for a case in which only one server using a given port is running on a network, but for simple static rules I seem to be blocked from entering a different translated port number from the orginal port number, which becomes a problem when two servers we need to access from the outside are running software using the same port number.
What is the simplest way to address this need? I am guessing that I need to set up a scenario like this, where port 5004 (or any arbitrarily choosen unused port, can be used to access the second server:
Outside user enters FQDN:5004 and this translates to Database server # 1 as 192.168.1.40:5003
and
Outside user enters FQDN:5003 and this translates to Database server # 1 as 192.168.1.38:5003
If so, what is the easist way to get this done? Or is there a better what to handle this scenario?
Thanks in advance,
James

I would create two objects and use object NAT
object network Obj_5004
host 192.168.1.40
object network Obj_5004
nat (inside,outside) static service tcp 5003 5004
object network Obj_5003
host 192.168.1.38
object network Obj_5003
nat (inside,outside) static service tcp 5003 5003
Of course you will need to open your outside interface for tcp ports 5003 and 5004 to make this happen

How to send to multiple people using same port?

I am trying to have one person send TWO audio sources to 10 others using same port- lets say 12345. I get "Can't open local data port:" error. The first audio is fine since I just use .addTarget(). Is there a way i can do the same for the 2nd audio source still using the same port? thanks!

As far as I know, you should transmit using even-numbered ports, eg. 22222 and 22224.
I think a port numbered 22223 and 22225 are opened respectively to handle control information.
Could be wrong, but try it anyway!
StHogan

Two web servers cant use same port forwarding rule???

I have two web servers, each configured to respond to http reqests on port 80. I use NoIP service to map a domain name to my router. I create a port forwarding assignment for Server A by selecting the WebServer rule in the port forwarding rule table. All is fine. For Server B, I select the same Webserver rule and the router says there is a conflict.
I don't understand why. I think the router has enough information to route a http request for Server B by knowing its MAC address, which is different than Server A MAC address.
What am I missing here???
I was able to do this on my previous router with DD-WRT.....
So it would appear the way to resolve this is to assign a different port address to Server B???
grrrrrrrrrr I hate this router

You shouldn't have been able to do that on any router. You have to change the listening port of server 2, to 8080 or something like that, or make one a secure server and run it over 443
That is a known issue with port forwarding
Problem #8:
Same Port in Multiple Rules
There are some routers such as Linksys, D-Link and many others that do not do any checks if a port is already in another port forwarding rule. A port can only be forwarded to one Computer/IP at a time. So when there are multiples of the same port number the port forwarding rule will not work.
Here is an example.
As you can see port 2350 is in 2 rules. The 1st one points to a different IP than that of the 2nd rule. So the router will honor the 1st rule and the 2nd port forwarding rule to port 2350 fails.
By removing the 1st rule the 2nd one will now work.

Monitoring two servers with same IIS configuration using SCOM

Hello,
We have two servers which has the same IIS configuration including sites names, how do we configure APM to monitor and get events captured on two different monitors on SCOM 2012 R2.
Thank you, Anand
Anand Franklin

Hi Anand,
There is no problem at all, if applications IIS paths (Web Site names + Web application name in IIS) absolutely match. Make sure both servers have SCOM Agent installed and connected to the same Management Group.
In .NET Application Performance Monitoring template just keep Target Group field blank (it's blank by default) - that will mean the application will be monitored on each server within Management Group where it's discovered. The same configuration of
APM monitoring will be used for all app instances.
If you want to monitor the app only on two servers, and at the same time the app is hosted on more than these two boxes, you can create Windows Computer group populated with appropriate servers and specify this group as Target for APM monitoring.
If you want to differentiate APM configuration for specific app instances, you should create several Windows Computer groups and bind each group with separate configuration - in this case you will have to run .NET Application Monitoring template several
times, picking up the same app, but changing APM settings and setting new Target Group.
Igor Savchenko, VIAcode Consulting LLC (http://www.viacode.com/)

Port forwarding between two servers from Same subnet

Hi,
We have a Cisco ASA 5520 Version 8.4(3). There exists a site to site VPN tunnel between us and a client and the client sends us the data to our local host/server 10.x.x.20 on port 52944. So 10.x.x.20 gets data on port 52944. We want to forward this data to a test server 10.x.x.21( same subnet IP) on port 52945. so basically I want to forward traffic from 10.x.x.20:52944 to 10.x.x.21:52945.
Is this possible. I am a new bee to the networking and still learning. Excuse me if this sounds silly.
I know we can add one more ACL in the VPN tunnel and add this test server IP in the ACL. but, then I have to ask the clinet to change their ACL too. I dont want to do this. So I want to wrok around it. Any help or suggestions is much appreciated.
Thanks in advance :)
This is my first ticket in the support community.
cs

VMs have nothing to do with it, as long as there's network communication between the servers.
As I said, there must be a service or application listening on that port for it to respond. For example, try this:
C:\> telnet
When the telnet prompt opens, type in:
open mail.messaging.microsoft.com 25
If it works, you should see this:
220 CH1EHSMHS035.bigfish.com Microsoft ESMTP MAIL Service ready at Thu, 7 Feb 2013 00:57:33 +0000
That means that Microsoft's mail servers are LISTENING on port 25 and it responded. And note, telnetting to port 25 is a non-default telnet port, because port 23 is the default telnet port. When you type in a space and then a port number, you're telling
the telnet client to use that port.
That is the SAME THING if some sort of application or service is listening on port 8444 on that other server you're trying to telnet to. If there is no app or service listening, it will just time out.
And no, installing the TELNET service on that sercver will NOT answer to any port other than 23. The telnet service by default, uses TCP 23, unless you specify otherwise.
So once again, what service or app on that server is supposed to be listening on 8444?
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

Static NAT with two outside interfaces

I have a router, which performs NAT on two outside interfaces with load balancing and had a task to allow inbound connection to be forwarded to the specific host inside on a well known port.
here is example
interface Fas0/0
ip nat outside
interface Fas0/1
ip nat outside
interface Vlan1
ip nat inside
ip nat inside source route-map rm_isp1 pool pool_isp1
ip nat inside source route-map rm_isp2 pool pool_isp2
all worked fine
then i tried to add static nat
ip nat inside source static tcp 10.0.0.1 25 interface Fas0/0 25
ip nat inside source static tcp 10.0.0.1 25 interface Fas0/1 25
and in result only last static NAT line appeared in config.
the solution was to use interface's IPs instead of names. that helped but isn't that a bug?

In this scenario, we are trying to access a mail server located at
10.0.0.1 from outside and we have two outside IP, let's say, 71.1.1.1 and
69.1.1.1.
With CEF Enabled
Packet comes in to Fa0/0 interface with Source IP 66.x.x.x and
Destination IP 71.1.1.1. Our NAT rule translates this to 10.0.0.1.
Packet goes to 10.0.0.1. The return packet goes to the LAN interface
first and the routing rule is determined *before* the packet is
translated.
Packet source IP at this point is 10.0.0.1 and destination is
66.x.x.x. Now, based on CEF, it will go out via Fa0/0 or Fa0/1,
irrespective of the way it came in. Because of this, with CEF enabled
this will not work. CEF is per-destination.
So, let's say somebody on outside tried to access this server using 71.1.1.1, then he would
expect a reply from 71.1.1.1 which may or may not be true as the traffic could be Nat'd to 69.1.1.1 or 71.1.1.1.
If it gets reply packet from 71.1.1.1, it should work.
If it gets it from 69.1.1.1, it will simply drop it as it never sent a
packet to 69.1.1.1.
With CEF and Fast Switching Disabled
Same steps as above, only that the packet is sent to the process level
to be routed. At this point, the packets will be sent out in a round
robin fashion. One packet will go out via the Fa0/0 and the other via the
Fa0/0. This will have a constant 50% packet loss and is also not a
viable solution.
So, what are you trying to achieve is not possible on Cisco router.
HTH,
Amit Aneja

Cannot get Telnet to work between two servers on same subnet

I need to test if communication is open on port 8444 between two servers.
I installed telnet client on a Server 2008 R2 server and telnet server on a Server 2008 SP2 server. I also manually started the Telnet service that was set to disabled on the SP2 server. I disabled the Windows firewall on both servers. They
are both on the same subnet so they don't need to go through any routers and I can ping successfully.
When I try to telnet to the remote server by typing telnet "ip address" 8444, I get an error that says "Could not open connection to host, on port 8444: Connection failed.
I tried other ports like port 80 and got the same error.
What else is needed to get this to work?

VMs have nothing to do with it, as long as there's network communication between the servers.
As I said, there must be a service or application listening on that port for it to respond. For example, try this:
C:\> telnet
When the telnet prompt opens, type in:
open mail.messaging.microsoft.com 25
If it works, you should see this:
220 CH1EHSMHS035.bigfish.com Microsoft ESMTP MAIL Service ready at Thu, 7 Feb 2013 00:57:33 +0000
That means that Microsoft's mail servers are LISTENING on port 25 and it responded. And note, telnetting to port 25 is a non-default telnet port, because port 23 is the default telnet port. When you type in a space and then a port number, you're telling
the telnet client to use that port.
That is the SAME THING if some sort of application or service is listening on port 8444 on that other server you're trying to telnet to. If there is no app or service listening, it will just time out.
And no, installing the TELNET service on that sercver will NOT answer to any port other than 23. The telnet service by default, uses TCP 23, unless you specify otherwise.
So once again, what service or app on that server is supposed to be listening on 8444?
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

Static NAT inbound correct - Outbound using Interface IP

Here is the scenario that i have:
I have a router (2921) that has 2 interfaces:
G0/0 - WAN - 10.254.1.10
G0/1 - LAN - 192.168.1.230
I have a few static NATs for servers that are behind g0/1, this is the only nat config i have except for an 'ip nat inside' and 'ip nat outside' on the interfaces:
ip nat inside source static 192.168.1.231 10.254.1.11
ip nat inside source static 192.168.1.232 10.254.1.12
ip nat inside source static 192.168.1.240 10.254.1.13
I can connect to each of these on their respective NAT'd IP.
The issue that i have is when these servers go out they have the interface IP address! So if i ping a server that is across the way i see
SRC: 10.254.1.10 DST: 10.1.2.11 Protocol: ICMP
I do not understand how this would work?? i have no other NAT configuration in the router.

Here is the NAT table when pinging from the outside to one of the NAT'd servers:
Pinging from 10.1.2.11 to 10.254.1.13
Cisco2921#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- 10.254.1.11 192.168.1.231 --- ---
tcp 10.254.1.12:80 192.168.1.232:80 10.1.2.11:62512 10.1.2.11:62512
tcp 10.254.1.12:443 192.168.1.232:443 10.1.2.11:62491 10.1.2.11:62491
tcp 10.254.1.12:443 192.168.1.232:443 10.1.2.11:62493 10.1.2.11:62493
--- 10.254.1.12 192.168.1.232 --- ---
icmp 10.254.1.13:1 192.168.1.240:1 10.1.2.11:1 10.1.2.11:1
tcp 10.254.1.13:22 192.168.1.240:22 10.1.2.11:62386 10.1.2.11:62386
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62508 10.1.2.11:62508
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62510 10.1.2.11:62510
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62511 10.1.2.11:62511
icmp 10.254.1.10:21531 192.168.1.240:21531 10.1.2.11:21531 10.1.2.11:21531
udp 10.254.1.10:38288 192.168.1.240:38288 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:55051 192.168.1.240:55051 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:55383 192.168.1.240:55383 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:58944 192.168.1.240:58944 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:59854 192.168.1.240:59854 10.1.2.1:161 10.1.2.1:161
--- 10.254.1.13 192.168.1.240 --- ---
Here is from an internal server to the same outside host:
Pinging from 192.168.1.240 to 10.1.2.11
Cisco2921#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- 10.254.1.11 192.168.1.231 --- ---
tcp 10.254.1.12:80 192.168.1.232:80 10.1.2.11:62517 10.1.2.11:62517
tcp 10.254.1.12:443 192.168.1.232:443 10.1.2.11:62491 10.1.2.11:62491
tcp 10.254.1.12:443 192.168.1.232:443 10.1.2.11:62493 10.1.2.11:62493
--- 10.254.1.12 192.168.1.232 --- ---
tcp 10.254.1.13:22 192.168.1.240:22 10.1.2.11:62386 10.1.2.11:62386
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62515 10.1.2.11:62515
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62516 10.1.2.11:62516
tcp 10.254.1.13:80 192.168.1.240:80 10.1.2.11:62518 10.1.2.11:62518
icmp 10.254.1.10:7163 192.168.1.240:7163 10.1.2.1:7163 10.1.2.1:7163
icmp 10.254.1.10:7184 192.168.1.240:7184 10.1.2.1:7184 10.1.2.1:7184
icmp 10.254.1.10:11548 192.168.1.240:11548 10.1.2.11:11548 10.1.2.11:11548
udp 10.254.1.10:38288 192.168.1.240:38288 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:53384 192.168.1.240:53384 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:58383 192.168.1.240:58383 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:58944 192.168.1.240:58944 10.1.2.1:161 10.1.2.1:161
udp 10.254.1.10:59143 192.168.1.240:59143 10.1.2.1:161 10.1.2.1:161
--- 10.254.1.13 192.168.1.240 --- ---

Static NAT entry disappears when using NVI on Cisco 1921 (Multiple versions)

We have a Cisco 1921 as an IPSec tunnel endpoint where we assign static NAT entries. It is a static one-to-one NAT putting each remote endpoint as a local /24 subnet. We are using NVI and we see some of these static entries disappear when packets are unable to reach the destination.
The production router is running 15.0(1r)M16 but we were able to reproduce this same behavior on 15.4(1)T2.
To reproduce, we add the static NVI entry:
ip nat source static X.X.X.X 172.30.250.11
And things look good for a bit:
ROUTER# sh ip nat nvi trans | i 172.30.250.11
gre 172.30.250.11:0 X.X.X>X:0 Y.Y.Y.Y:0 Y.Y.Y.Y:0
--- 172.30.250.11 138.54.32.9 --- ---
tcp Y.Y.Y.Y:60360 Z.Z.Z.Z:60360 172.30.250.11:22 X.X.X.X:22
There is a known issue with GRE traffic being dropped at this particular endpoint, so after generating GRE traffic, the entry completely disappears:
ROUTER# sh run | i 172.30.250.11
ROUTER#
ROUTER# sh ip nat nvi trans | i 172.30.250.11
gre 172.30.250.11:0 X.X.X>X:0 Y.Y.Y.Y:0 Y.Y.Y.Y:0
icmp Y.Y.Y.Y:59916 Z.Z.Z.Z:59916 172.30.250.11:59916 172.30.250.11:59916
tcp Y.Y.Y.Y:60360 Z.Z.Z.Z:60360 172.30.250.11:22 X.X.X.X:22
I can reproduce this by severing the tunnel to any other remote site, and after generating GRE traffic to the downed endpoint, the corresponding static NAT entry will disappear.
Debugging has not shown anything, and I have found some mentions of similar behavior on older versions. Has anyone seen this? We don't have support access to test all versions, so if it is known to be resolved in a particular one, we would love to know to work towards loading that version.
Thanks

Hi Ryan,
Asa cannot ahve 2 default routes, it can only have one. ASA also doesnt support PBR, so the setup that you are trying to configure would not work on the ASA. Router is the correct option for it.
Hope that helps.
Thanks,
Varun Rao
Security Team,
Cisco TAC

Two instance with same port number in one machine.

How can I config one machine(one IP) to listen to two different URLs with same port? (http://www.abc.com & http://www.xyz.com)??

What you are looking for is a feature called virtual servers. Lots of information in Chapter 13 of the admin guide.
The key is that there is only one server instance. (One available port pretty much implies one server instance.) But the virtual server feature allows you to specifiy different "virtual" servers based on the URL characteristics. (such as domain name)

Two apps sharing same port

Hi, I have two applications running on Windows 7 Home premium which both use port 443 - Battlefield 4 and WD MyCloud.
With the remote access enabled on the Mycloud, battlefield4 loses server connectivity after a period, typically 30 minutes or so.
Turning off the Mycloud remote facility removes the battlefield4 server disconnects - but this is not an ideal fix.
I'm new to port forwarding but did attempt to forward port 43 to 491 (random choice on my part). This port config on the BT Router I named bf4. However this did not work and I wonder how the router knows I only want the Battlefied4 forwarded and not
WD Mycloud. Am i going about this the right way?
Any advice gratefully received.
Regards
Graham

Hi,
Skype might use port 443, but all depends on your configuration, you can refer to this guide to change the settings
Which ports need to be open to use Skype for Windows desktop?
https://support.skype.com/en/faq/FA148/which-ports-need-to-be-open-to-use-skype-for-windows-desktop
1) can several running applications use the same port e.g. Skype, BF4 and MyCloud?
Extracted from the MSDN article
The TCP/IP protocol uses a 16-bit number, called a port, to differentiate connections to multiple network applications running on the same machine. If an application is listening on a port, then all TCP traffic for that port goes to that application.
Other applications cannot listen on that port at the same time.
http://msdn.microsoft.com/en-us/library/aa395195(v=vs.110).aspx
I also would like to sharing this link with you
http://stackoverflow.com/questions/1694144/can-two-applications-listen-to-the-same-port
2) If I forward port 443 to a different port on my PC, how does this only work for a specific app?
Personally, the application declares on which port it is listening. to change the port for an applciation, I suggest you contact the application vender, or you need to check with the documentation of that specific application.
NOTE
This
response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you.
Microsoft
does not control these sites and has not tested any software or information found on these sites.
Yolanda Zhu
TechNet Community Support

Can two computers use same iTunes library on a network drive?

Can two computers use directly (rather than share) the same iTunes library on a network drive?
My media library is on a network drive attached to my Airport Extreme. Right now I share the library with my desktop Mac. I can share fine, but I would like to be able to add, delete, and make other changes in the media library from both computers. The two computers would not be accessing the library at the same time as I am the sole user of both.

I appreciate your input and I think you're right about this being impossible. But just to clarify, you say I can't "have multiple machines accessing the same music files from a shared location." I can have multiple machines accessing the same music files from a shared location--I just can't have them accessing the same music files simultaneously--which may have been what you meant. For my situation, I think it will be less work to just quit iTunes on my server when I want to run it on my client (using Chicken of the VNC). It's not ideal, but it's less time-consuming than periodically syncing three computers.
Again, thanks for the input.

Several instances using same port question

Good Morning,
I am going to have to create several instances on one box using solaris 10 zone technology. Each zone haveing it's own instance. I need to confirm whether or not that all those instances can use one listerner or does each instance need it's own separate port such as 1521, 1522 etc. for it's listener.
Your opinion and recommendation on this matter will be much appreciated.
regards,
al

 > Good Morning,
 >
 > I am going to have to create several instances on one
 > box using solaris 10 zone technology. Each zone
 > haveing it's own instance. I need to confirm
 > whether or not that all those instances can use one
 > listerner or does each instance need it's own
 > separate port such as 1521, 1522 etc. for it's
 > listener.
 >
 > Your opinion and recommendation on this matter will
 > be much appreciated.
 >
 > regards,
 >
 > al
 
 Hi,
 
 As you are going to be using Solaris Zones would you really want to have one listener for all of the instances?
 
 Surely the point of using Zones is separation of the environments so why would you want to try and break that by not having separate listeners? If you aren't interested in isolating the environments then Zones seems like an added headache you can do without.
 
 On the question of ports... each Zone is going to have its own IP address so it really doesn't matter what port you choose. They could all have the same port for their individual listeners or they could all have different ports. Makes no odds really.
 
 Hope that helps.

Installing oracle10g on two servers with same databae

Dear DBAs
I have two servers and one SCSI SATA box as storage device which i have configured in RAID5 format. Servers are connected to channel 0 and 1 of the SATA box respectively.My OS is RHEL ES-4
I want to install Oracle10g on these two machines with SATA box as the Databse Storage medium. I donot want to use RAC as my clients donot have DBA. The servers has to be configured in a failsafe method.

hi gert
the SATA SCSI box is LSI Logic Megaraid sas 8408E. My aim is to have a backup server which needs to be switched on once the main server fails. I can afford for a little bit data loss. Only thing is the backup server should use the data files of the crashed server.

Static NAT to two servers using same port

Similar Messages

Maybe you are looking for