Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

PIX doesn't NAT outbound packets to correct IP

Hello all,

I have a PIX 515E running v6.1(2). The firewall has an external and internal interface only. The webservers and mail server are behind the firewall on the internal network. We have 1 external address reserved for all outbound connections from PCs. I have several static configurations set for inbound connections to the web and mail servers.

The mail server is using an external address of XXX.XXX.XXX.105 which the PIX passes through to my internal address of XXX.XXX.XXX.24. The outbound connections from XXX.XXX.XXX.24 end up using the external address of XXX.XXX.XXX.109. I need it to use the 105 address so other mailservers will accept our emails. I understand from my reading is that all I need is the static config and an access-list entry for outbound-in connections to make it all possible.

What am I doing wrong? Any information would be appreciated. Following is the relevant config:

nameif ethernet0 outside security0

nameif ethernet1 inside security100

...

name XXX.XXX.XX6.109 extnat

name XXX.XXX.XX6.105 extmail

name XXX.XXX.XX8.24 intmail

...

access-list 111 permit tcp any host extmail eq smtp

access-list 211 permit ip XXX.XXX.XX8.0 255.255.255.0 XXX.XXX.X10.0 255.255.255.0

...

global (outside) 1 extnat

nat (inside) 0 access-list 211

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

...

static (inside, outside) extmail intmail netmask 255.255.255.255 0 0

...

access-group 111 in interface outside

1 ACCEPTED SOLUTION

Accepted Solutions

Re: PIX doesn't NAT outbound packets to correct IP

The configuration looks good. After you added the static did you do a 'clear xlate' for the static to take effect?

2 REPLIES

Re: PIX doesn't NAT outbound packets to correct IP

The configuration looks good. After you added the static did you do a 'clear xlate' for the static to take effect?

Community Member

Re: PIX doesn't NAT outbound packets to correct IP

I did as you suggested and I'm not getting bounced emails any more, so that must've fixed it.

Come to think of it, the mail server _was_ moved to different hardware, so maybe something with the MAC address was still hung up in the translation tables?

Thanks for the fix. A reload of the PIX didn't work, but running that command did.

137
Views
0
Helpful
2
Replies
CreatePlease to create content