Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Multiple MX records with PIX and ASA5510

I need some help with a setup for email.


I have a PIX525 and an ASA5510VPN and an internal 2950 router. The PIX does firewalling and the ASA does VPN. Currently all outbound Internet traffic goes through the PIX via the router with this command:

ip route 1

The ASA5510 with its dedicated external IP is used to allow VPN traffic in.

The problem:

I have two separate domain names and two MX records. One ( pointed at the external IP of the PIX the other ( is pointed at the ASA5510. I can receive inbound mail through both of the devices. I'd like to mail go out using both domains one through PIX and the other thru ASA. The problem is the router says all unknown traffic go to PIX.

How do I route mail from a host ( to the ASA5510(, while sending the mail from host ( to PIX(


Re: Multiple MX records with PIX and ASA5510

You need to implement Policy Based Routing (PBR). There is a differing Next Hops example in the document

Just one thing, the 2950 is a Layer2 switch, not a router, you will need a PBR capable device as your gateway for this to work.

New Member

Re: Multiple MX records with PIX and ASA5510

I setup PBR but it killed my routes to my WAN sites. I'm wondering if it had anything to do with putting the ACL on ethernet interface of the LAN. Once I use an ACL doesn't it by default block all other traffic not specified by the ACL(s)?

New Member

Re: Multiple MX records with PIX and ASA5510

Why don't you just set the default gateway of to the ASA and have use the pix as it's default gateway.

Problem solved.


New Member

Re: Multiple MX records with PIX and ASA5510

That's currently how it's setup. However my VPN users need access to the network, the inside address ( of the VPN is routed the this router ( and all of these devices are on the same subnet. When send a message from, which by the is running Postfix, with the default gateway set to, the header indicates that it came from or when it should have come from ( or

New Member

Re: Multiple MX records with PIX and ASA5510

I am not folliwing something here. If your gateway for is truly set to the ASA and the ASA has the nat rule on the outside for the address there should be no issue. It sounds like you are sending your traffic back out the pix interface. If your gateway is the address the router will send the traffic to the PIX or redirect you to do so with an ICMP redirect.

Just the simple fact that it's coming out with the wrong external address leads me to beleive that that is the issue.

Any configs/route tables on the servers and firewalls would help.