2 public ip addresses - Nat?

[Chapie01]

We have a smtp server which has 2 mx records, currently we have NAT'd 1 of the public ip addresses on our CPoint NG1 fp3 firewall.

How can we assign 2 public ip addresses to 1 NAT'd address in checkpoint?

Thank you for your suggestions.

 

[ChrisAC]

I don't think that you can, and what would be the point?

I can't see any reason for having two MX records that are actually the same server? If the primary is down then so is the secondary! You should have your secondardy MX as another mail server/spooler.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[rn4it]

We have 2 MX records pointing to the same public IP, this is NAT'd a mail filter server which after filtering forwards the email for 2 separate companies individual email servers.

 

[ChrisAC]

Two MX records, one for each domain is quite different to two for the same domain, each pointing to the same IP.

The point that I am making for the OP is that even if the firewall could be configured to NAT two public IP's to the same mail server, if the mail server doesn't respond, neither MX record would work as they both point to the same server just with two different public IP's.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[rn4it]

Sorry Chris, I was just mentioning a scenario that we do with multiple mx records. I was wondering if it may be a similiar scenario.
Chapie01: What is the importance of having 2 public IP's to 1 private IP?

 

[shaggerTM]

Whether or not it makes sense to NAT 2 different inbound addresses to the same protected IP address, it is very easy to do using manual static NAT.

The problem is actually for outbound initiated connections, since you must select just one address for the outbound connection.

As for the desirability. It's true that if you have just one incoming pipe, whether you have one or more routed address blocks, then multiple MX's to a single host offers no benefit at all.

However, it's comparatively simple to use 2 incoming pipes, with separate address blocks, to publish 2 MXs, one on each address range, both targetting a single mailserver behind the firewall. In this instance, whilst there is still a single point of failure in the mailhost itself, there is a resillience in the inbound routing.

If anyone is interested in how this kind of thing works (if you aren't using the SPLAT ISP loadsharing features) then give me a shout.



========================================
Find out about what I do for a living at

http://www.ascltd.co.uk

========================================