Multiple MX records with PIX and ASA5510

Unanswered Question

I need some help with a setup for email.

Setup

I have a PIX525 and an ASA5510VPN and an internal 2950 router. The PIX does firewalling and the ASA does VPN. Currently all outbound Internet traffic goes through the PIX via the router with this command:

ip route 0.0.0.0 0.0.0.0 10.1.1.2 1

The ASA5510 with its dedicated external IP is used to allow VPN traffic in.

The problem:

I have two separate domain names and two MX records. One (mail.PIX.com)is pointed at the external IP of the PIX the other (mail.ASAVPN.com) is pointed at the ASA5510. I can receive inbound mail through both of the devices. I'd like to mail go out using both domains one through PIX and the other thru ASA. The problem is the router says all unknown traffic go to PIX.

How do I route mail from a host (10.1.1.5) to the ASA5510(10.1.1.4), while sending the mail from host (10.1.1.3) to PIX(10.1.1.2)

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
cdusio Thu, 02/28/2008 - 16:12

Why don't you just set the default gateway of 10.1.1.5 to the ASA and have 10.1.1.3 use the pix as it's default gateway.

Problem solved.

Chris

That's currently how it's setup. However my VPN users need access to the network, the inside address (10.1.1.4) of the VPN is routed the this router (10.1.1.254) and all of these devices are on the same subnet. When send a message from 10.1.1.5, which by the is running Postfix, with the default gateway set to 10.1.1.4, the header indicates that it came from mail.everfast.com(xxx.xxx.xxx.83 or 10.1.1.3) when it should have come from mail.calicocorners.com (xxx.xxx.xxx.94 or 10.1.1.4)

cdusio Fri, 02/29/2008 - 08:53

I am not folliwing something here. If your gateway for 10.1.1.5 is truly set to the ASA and the ASA has the nat rule on the outside for the 10.1.1.5 address there should be no issue. It sounds like you are sending your traffic back out the pix interface. If your gateway is the 10.1.1.254 address the router will send the traffic to the PIX or redirect you to do so with an ICMP redirect.

Just the simple fact that it's coming out with the wrong external address leads me to beleive that that is the issue.

Any configs/route tables on the servers and firewalls would help.

Actions

This Discussion