How to publish IIS website with static external IP address

[ZEBIT]

Hi,

We have an ECommerce website that need to access our servers that are in our DMZ zone. These servers has IP 172.x.x.5, 172.x.x.6 and 172.x.x.8, these servers are configured in a cluster with IP 172.x.x.7. So incoming and outgoing communication is through the cluster IP address.

I configured, if from any source wants to contact IP 194.x.x.187 it has to be NAT to the cluster IP address. From intern connections this works and we get a window to authenticate to the servers and that is what we want. If I do the same from external IP address (from my home computer), I only get a blank page. In the firewall monitoring I see that this connection is allowed, without any problem.

What I think the problem is, that I need to configure that the DMZ address 172.x.x.7 needs to be translated to the external IP address 194.x.x.187, because otherwise the server will answer with a different IP address and the client doesn't recognize it.

But how do I configure this, if my theory is right?

Thanks in advance.

[bat]

Hi ZEBIT

Could you please attach the snapshot or mention how the NAT and security policies are configured for this server cluster located in DMZ zone ?

[ssharma]

Hi Zebit,

Based on your description, you can configure following NAT and Security policy :

1. NAT

Untrust to Untrust if destination is 194.x.x.187 translate to 172.x.x.7

2. Security

Untrust to DMZ if destination is 194.x.x.187 allow

Just to test move both of these rules to test, commit and test it from external connection and see if that resolves the issue. Thank you.

[hshah]

Hi Zebit,

Please provide us snapshot for traffic log for untrust to DMZ. That will help us to determine policy, NAT or server issue.

Regards,

Hardik Shah

[ZEBIT]

Ok I found the problem. The problem was not the firewall but the authentication with the IIS authentication method. This needs to be NTLM.

[hshah]

Hi Zebit,

I am glad you found the issue. Always try to look traffic log, You can determine NAT, Policy or pre/post firewall issues from it.

Regards,

Hardik Shah