This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

2 virtual web servers on one external IP

Hi All,

Does anyone do this?

For example there is one external IP address on an additional adapter configured.

This is then used on a virtual webserver going to a real webserver. I then have a NAT using the same interface (external IP) going to a different webserver over https only allowing specific IPs.

I'm getting errors for URL hardening saying that something is trying to go to one or the other and it doesn't exist (obviously traffic is just going to both).

Is there a way round this or should I not be doing it?

Thanks
Ross

This thread was automatically locked due to age.

0 Scott_Klassen over 9 years ago

Are you using the same firewall profile for both virtual webservers?

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 Ross86 over 9 years ago in reply to Scott_Klassen

Hi Scott,

Sorry I got my config a bit wrong, I've updated my orignal post.

Both services are on the same IP but only one of them is on the WAF, the other is a NAT so this may be where the problem lies. Am I right in saying the WAF is processed before the NAT? If so I guess my service on the NAT is also trying to go through the WAF rule.

Thanks
Ross
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 9 years ago

Hi,

NAT comes first; see rule #2: https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/22065

Are they on different ports? Otherwise, you can't DNAT AND use the WAF for 2 sites on the same port and IP.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Ross86 over 9 years ago

Hi Barry,

Ok thanks, yes both https 443. They both seem to be working (as far as I know one definitely is fully working) the errors in the WAF log is why I asked so it seems to be getting to the WAF.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

Ross, what you described in your last post isn't possible. Please click on [Go Advanced] below and attach pictures of your DNAT and two Virtual Server definitions all open in Edit.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Ross86 over 9 years ago

Hi Bob, sure I'll post tomorrow when I'm back in the office.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ross86 over 9 years ago

I've attached the pics... blocked out the server names etc but left the last part of the external IP so you can see they are both on .91.
- DNAT.PNG
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 9 years ago

Get rid of the DNAT, and setup virtual web servers for BOTH servers, and make sure the certificate(s) are installed in the UTM.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Ross86 over 9 years ago

Ok thanks Barry. If I wanted the virtual web server to only be accessed by specific addresses do I achieve this through a manual firewall rule?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 9 years ago

The WAF bypasses the firewall rules so you'd have to use the WAF controls.

Barry
Cancel
Vote Up 0 Vote Down

Cancel