ecure server has been built using HTTPS, which listens on TCP port 443. The problem is a lack of public IP addresses. Assuming that the original web server only listens on TCP port 80, we can solve the problem using port redirection. Using capabilities introduced in release 6.x, we can specify that incoming traffic des- tined for the 10.0.0.6 IP address on TCP port 80 be translated to one IP address inter- nally, while packets destined for the same IP address on TCP port 443 be sent to another IP address: static (inside,outside) tcp 10.0.0.6 80 192.168.1.6 80 netmask 255.255.255.255 static (inside,outside) tcp 10.0.0.6 443 192.168.1.7 443 netmask 255.255.255.255 Chapter 28: ASA Firewall Configuration Normally, the static command includes only the outside and inside IP addresses, and all packets are sent between them. Including the port numbers makes the static state- ment more specific. The result is that packets destined for 10.0.0.6 will be translated to different IP ad- dresses internally, depending on their destination ports: a packet sent to 10.0.0.6:80 will be translated to 192.168.1.6:80, while a packet destined for 10.0.0.6:443 will be translated to 192.168.1.7:443. You can even change the port to something else if you like. Here is a very common scenario: a company has put an ASA in place for Internet se- curity. Certain servers need to be accessed from the Internet. These servers will be in a DMZ. The outside interface connects to the Internet, the inside interface connects to the company LANs, and the DMZ contains the Internet-accessible servers. This net- work is shown in Figure 28-16. Internet Outside 0 10.0.0.0/24 DMZ-50 192.168.100.0/24 Remote Support Inside 100 192.168.1.0/24 Web Servers Figure 28-16. Firewall with DMZ From a NAT point of view, we must remember that the security levels are important. The outside interface has a security level of 0, the inside interface has a level of 100, and the DMZ has a level of 50. In this case, we want the servers in the DMZ to be accessible from outside. We 