I have a PIX525 and an ASA5510VPN and an internal 2950 router. The PIX does firewalling and the ASA does VPN. Currently all outbound Internet traffic goes through the PIX via the router with this command:
ip route 0.0.0.0 0.0.0.0 10.1.1.2 1
The ASA5510 with its dedicated external IP is used to allow VPN traffic in.
I have two separate domain names and two MX records. One (mail.PIX.com)is pointed at the external IP of the PIX the other (mail.ASAVPN.com) is pointed at the ASA5510. I can receive inbound mail through both of the devices. I'd like to mail go out using both domains one through PIX and the other thru ASA. The problem is the router says all unknown traffic go to PIX.
How do I route mail from a host (10.1.1.5) to the ASA5510(10.1.1.4), while sending the mail from host (10.1.1.3) to PIX(10.1.1.2)
I setup PBR but it killed my routes to my WAN sites. I'm wondering if it had anything to do with putting the ACL on ethernet interface of the LAN. Once I use an ACL doesn't it by default block all other traffic not specified by the ACL(s)?
That's currently how it's setup. However my VPN users need access to the network, the inside address (10.1.1.4) of the VPN is routed the this router (10.1.1.254) and all of these devices are on the same subnet. When send a message from 10.1.1.5, which by the is running Postfix, with the default gateway set to 10.1.1.4, the header indicates that it came from mail.everfast.com(xxx.xxx.xxx.83 or 10.1.1.3) when it should have come from mail.calicocorners.com (xxx.xxx.xxx.94 or 10.1.1.4)
I am not folliwing something here. If your gateway for 10.1.1.5 is truly set to the ASA and the ASA has the nat rule on the outside for the 10.1.1.5 address there should be no issue. It sounds like you are sending your traffic back out the pix interface. If your gateway is the 10.1.1.254 address the router will send the traffic to the PIX or redirect you to do so with an ICMP redirect.
Just the simple fact that it's coming out with the wrong external address leads me to beleive that that is the issue.
Any configs/route tables on the servers and firewalls would help.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...