Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Global PAT with static NAT on PIX 6.3

I am having issues getting this to work.  For email, I have DNS'd to  I want it to come in to  It needs to go out a cluster of,, or but look like it came from the address.  I have set up static NAT for the inbound.  I have set up the global PAT with an ACL group of the addresses.  I have set this same method up on an ASA with no issues but it doesn't want to work on the PIX 6.3.  What am I missing?

no fixup protocol smtp 25

object-group service NewExchange tcp

  port-object eq https

  port-object eq smtp

  port-object eq 587

access-list inbound remark Exchange

access-list inbound permit tcp any host object-group NewExchange

access-list mail permit ip host any

access-list mail permit ip host any

access-list mail permit ip host any

global (outside) 1 interface

global (outside) 2

nat (inside) 2 access-list mail 0 0

nat (inside) 1 0 0

static (inside,outside) netmask 0 0

access-group inbound in interface outside

If I am on with this set up ... i lose internet connectivity.

If I remove the "nat (inside) 2 access-list mail 0 0" line .... i restore connectivity but it becomes the ip address of the interface in global 1.

any thoughts?

Cisco Employee

Global PAT with static NAT on PIX 6.3

You can't configure the same global address on static NAT and PAT.

You can however configure static PAT for your mail as follows:

static (inside,outside) tcp 25 25 netmask 0 0

Here is the command reference to confirm the correct behaviour:

(--> check out the explaination under "global_ip" column)

CreatePlease to create content