Help With Port Redirection And NAT

[ixleplix]

We recently added a spam server and therefore had to split the traffic comming in so that the smtp went to the spam server and

http://www went

to the exchange (For OWA). This has apparently had the effect that all traffic outbound from the exchange server (upon leaving the PIX) shows that it is comming from the main IP of the PIX x.x.x.136. Before it showed it was comming from the x.x.x.130 address which was statically mapped to y.y.y.16 (Exchange) inside.

This is a problem since we have a VPN tunnel connected to a network that also has an exchange server & apparently when their router is seing traffic from x.x.x.136 it sends it to their VPN concentrator which drops the packets (as it should). They of course believe that this is our problem. So.....

I thought I could use NAT to resolve this, but my attempted solution didn't work.
Here are the pertinent commands. os 6.3.1

access-list 100 permit tcp any host x.x.x.130 eq www
access-list 100 permit tcp any host x.x.x.130 eq smtp

static (inside,outside) tcp x.x.x.130

http://www y.y.y.16

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp x.x.x.130 smtp y.y.y.19 smtp netmask 255.255.255.255 0 0

This is the solution I tried that didn't work:

nat (inside) 2 y.y.y.16 255.255.255.255
global (outside) 2 x.x.x.130 netmask 255.255.255.255

After these commands Nothing from the exchange server seemed to be able to go through the PIX

Any help would be great!!!!

 

[308win]

you probably have a 'global 0 interface', can you change it to global 0 x.x.x.131 (or some other free address?)

Brian

 

[308win]

or pass smtp traffic between the two sites via the VPN and the internal IP addresses. Add the other sites mail server's inside address to the hosts file on your mail server and update the vpn/nat 0 access lists.

 

[yizhar]

HI.

You can simply use an additional IP address and map it to your Exchange server:
x.x.x.131 or any unused public IP.

Then use the normal STATIC command (as you did before the change) instead of port forwarding.

Side note - Ask your ISP to create reverse lookup PRT record for the new IP used by Exchange. It will help you avoid some problems with SMTP.

Bye


Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[ixleplix]

you probably have a 'global 0 interface', can you change it to global 0 x.x.x.131 (or some other free address?)


I will try this one, but it's going to be a few days before I'm able.

Thanks to all who replied. The help is always appreciated.

Roland