Multiple MX records with PIX and ASA5510

Unanswered Question

I need some help with a setup for email.


I have a PIX525 and an ASA5510VPN and an internal 2950 router. The PIX does firewalling and the ASA does VPN. Currently all outbound Internet traffic goes through the PIX via the router with this command:

ip route 1

The ASA5510 with its dedicated external IP is used to allow VPN traffic in.

The problem:

I have two separate domain names and two MX records. One ( pointed at the external IP of the PIX the other ( is pointed at the ASA5510. I can receive inbound mail through both of the devices. I'd like to mail go out using both domains one through PIX and the other thru ASA. The problem is the router says all unknown traffic go to PIX.

How do I route mail from a host ( to the ASA5510(, while sending the mail from host ( to PIX(

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
cdusio Thu, 02/28/2008 - 16:12
User Badges:
  • Bronze, 100 points or more

Why don't you just set the default gateway of to the ASA and have use the pix as it's default gateway.

Problem solved.


That's currently how it's setup. However my VPN users need access to the network, the inside address ( of the VPN is routed the this router ( and all of these devices are on the same subnet. When send a message from, which by the is running Postfix, with the default gateway set to, the header indicates that it came from or when it should have come from ( or

cdusio Fri, 02/29/2008 - 08:53
User Badges:
  • Bronze, 100 points or more

I am not folliwing something here. If your gateway for is truly set to the ASA and the ASA has the nat rule on the outside for the address there should be no issue. It sounds like you are sending your traffic back out the pix interface. If your gateway is the address the router will send the traffic to the PIX or redirect you to do so with an ICMP redirect.

Just the simple fact that it's coming out with the wrong external address leads me to beleive that that is the issue.

Any configs/route tables on the servers and firewalls would help.


This Discussion