up vote 0 down vote favorite
share [g+] share [fb]

I have the need to receive requests for intranet.domain.com and webmail.domain.com on the same IIS webserver.

This webserver has two internal IP addresses which host each of these two subdomains.

Is anyone able to suggest how I might go about using the Cisco ASA 5505 I have implemented to redirect queries for each URL through to the corresponding private internal IP hosted on the web server?

Both websites are hosted on port 443 using the same digital (wildcard) certificate.

I am able to do this using host headers and updating the SecureBindings attribute in the metabase but this has killed off ActiveSync's ability to push emails.

link|improve this question
29% accept rate
feedback

migrated from stackoverflow.com Jul 4 '11 at 7:53

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 1 down vote

You can't have two different secure (https) websites hosted on the same IP address.

I see you have addressed this on the webserver by having two internal IPs. However the traffic passing through the firewall will be encrypted, so the ASA can't read the host header, so can't redirect to the correct internal IP.

The simplest solution is to have two external IPs, each NATed to an internal IP on the webserver.

link|improve this answer
"You can't have two different secure (https) websites hosted on the same IP address." -- yes you can, it's called SNI, documented in RFC6066. – womble Jul 4 '11 at 8:48
1  
@womble - in an ideal world, yes. But it's not exactly globally supported, hence SSL's "one-site-one-ip" rule still (sadly) exists: en.wikipedia.org/wiki/Server_Name_Indication#No_support – Coops Jul 4 '11 at 8:56
You can host two https websites on the same IP address using IIS. Here is an example of how if anyone is interested: sslshopper.com/… – Lance Jul 5 '11 at 6:46
@Lance From your link: "But doing it this way requires that you always visit the site using the port number and always reference it in links with the port number". That sucks :-) – Coops Jul 5 '11 at 8:40
Coops - if your read the page the whole way down it is pointing out a failure of one approach (the one where you have to put the port number) and a way around it. I can access intranet.company.com and webmail.company.com no ports required. The next line after that quote states "There is a more elegant method, if you have IIS 6.0 or later. That method is to use SSL Host Headers". IE: You can have two hosts same external IP same port. I believe the failure of this issue is in adding host headers to the default website. – Lance Jul 5 '11 at 23:01
feedback
up vote 0 down vote

First of all - this is not something a Cisco ASA or NAT can solve for you.

I can see 3 potential solutions:

  1. Install a load balancer/frontend/proxy on your inside network on a different server, and re-route requests to the correct internal IP on the IIS based on the hostname requested
  2. Get another external IP and use port forwarding or one-to-one NAT to the secondary internal IP
  3. Re-configure your IIS to use a single IP (You're already using the same wildcard certificate)

EDIT: I wasn't aware of the SNI restrictions. I can't see any other solution than getting a second external IP

link|improve this answer
feedback
up vote 0 down vote

ASA is not the answer for certain.

OK so the answer is that it can be done but no host headers on the default website. As it is the default website the traffic still flows there but headers on the other sites allow hosting them on the same IP. Host headers on default website breaks Exchange Active Sync.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.