Is it possible to define a second publicly accessible IP to a PIX501 in an access list + static route (out to in) to forward web server traffic to a natted host on the inside? Basically a client currently uses an Linux IPCOP firewall with a dmz interface to forward 80/443 traffic to a web server with a non routable address. They want to put a PIX 501 unit in to act as a gateway for internal hosts as well as act as a VPN endpoint (to peer with a 501 unit at a different location) but they don’t want to lose the web server access functionality. Now the 501 doesn’t have a 2nd interface(DMZ). What I’m looking to achieve is to be able to configure pix501 thus:
1)outside address (this is the vpn end point address and the global PAT address for internal clients breaking out onto the internet
+
2nd address defined in access list:
access-list out_in permit tcp 80 any host <2nd public IP> eq 80
access-list out_in permit tcp 443 any host <2nd public IP> eq 443
+
static (inside,outside)
anyone managed to get this to work or is this solution a no goer with a 501?
cheers in advance
G