Exchange server & ASA 5540 outside interface sharing same IP address?

Unanswered Question
May 14th, 2008
User Badges:

Hi Gurus

Need some assistance here?

1.Need email access from outside but don't have a dedicated public IP for mail server. Can i share the same IP for both like the way ISA works? i.e PAT inside to outside then static NAT for exchange IP to public IP & allow smtp access from outside?

2. Need to inside to access DMZ without translation. I have done this:

interface GigabitEthernet0/1


security-level 100

ip address standby


interface GigabitEthernet0/2

nameif IF_DMZ

security-level 50

ip address standby

static (IF_LAN_INSIDE,IF_DMZ) netmask

but i cant access DMZ from INSIDE

removed the static command and did this:

access-list INSIDE_TO_DMZ_NONAT extended permit ip


this didn't work still. enable nat-control to no avail.

the only thing that works is nating from inside to DMZ.

any pointers?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
smahbub Tue, 05/20/2008 - 09:10
User Badges:
  • Silver, 250 points or more

In PIX 6.0, the Port Redirection(Forwarding) feature was added to allow outside users to connect to a particular IP address/port and have the PIX redirect the traffic to the appropriate inside server; the static command was modified. The shared address can be a unique address, a shared outbound PAT address, or shared with the external interface.

when a host on one PIX Firewall interface initiates a connection to a host on another interface, the PIX must have a way to translate that host's IP address across itself. Even if it is not necessary for the IP address to be translated, a translation must still occur. Therefore, in order to allow hosts on the inside access to hosts on the DMZ, a translation that does not actually translate must be configured.

Refer the following url for more info on allowing Inside Hosts Access to a DMZ without Translation:


This Discussion