Home / server / Questions / 286720
Accepted
Lance
Asked: 2011-07-04 18:18:38 +0800 CST

Two websites on one public IP address (behind a ASA 5510)

  • 772

I have the need to receive requests for intranet.domain.com and webmail.domain.com on the same IIS webserver.

This webserver has two internal IP addresses which host each of these two subdomains.

Is anyone able to suggest how I might go about using the Cisco ASA 5505 I have implemented to redirect queries for each URL through to the corresponding private internal IP hosted on the web server?

Both websites are hosted on port 443 using the same digital (wildcard) certificate.

I am able to do this using host headers and updating the SecureBindings attribute in the metabase but this has killed off ActiveSync's ability to push emails.

cisco nat

3 Answers

  1. You can't have two different secure (https) websites hosted on the same IP address.

    I see you have addressed this on the webserver by having two internal IPs. However the traffic passing through the firewall will be encrypted, so the ASA can't read the host header, so can't redirect to the correct internal IP.

    The simplest solution is to have two external IPs, each NATed to an internal IP on the webserver.

    • 1

  2. First of all - this is not something a Cisco ASA or NAT can solve for you.

    I can see 3 potential solutions:

    1. Install a load balancer/frontend/proxy on your inside network on a different server, and re-route requests to the correct internal IP on the IIS based on the hostname requested
    2. Get another external IP and use port forwarding or one-to-one NAT to the secondary internal IP
    3. Re-configure your IIS to use a single IP (You're already using the same wildcard certificate)

    EDIT: I wasn't aware of the SNI restrictions. I can't see any other solution than getting a second external IP

    • 0
  3. Best Answer

    ASA is not the answer for certain.

    OK so the answer is that it can be done but no host headers on the default website. As it is the default website the traffic still flows there but headers on the other sites allow hosting them on the same IP. Host headers on default website breaks Exchange Active Sync.

    • 0