Translation issues, affecting failover testing

[g.leonard]

What is the best setup for the following scenario? The only traffic permitted inbound is smtp to mail server. This is done using port redirection to internal mailserver:

static (inside,outside) tcp interface smtp X.X.X.X smtp netmask 255.255.255.255 0 0

Outbound traffic initiated by 4 servers. One of which is mail server. Would you be able to use a seperate address to the outside interface for the mail server to use when initiating outbound traffic or would you have to use a static to the same address as the interface. Would there be two translations for the same internal machine if different address was used?

What would be the best way to do this? 2 of the machines really need a static mapping as they would be initiating traffic regularly. The other machines only would initiate traffic once a day for example. However if a static mapping to the interface was used I would get all traffic to the interface forwarded to the mail server. ACLs could block this but in my experience this would add loads of messages to syslog and affect failover testing.

[scoclayton]

Hi,

Let me try to answer your questions in a QA format below.

Q: Would you be able to use a seperate address to the outside interface for the mail server to use when initiating outbound traffic or would you have to use a static to the same address as the interface?

A: Well, sither one of these (sort of) would work. In most cases, people just add something like this to the config to allow the internal server to initiate conns outbound:

nat (intf) 2

global (outside) 2 interface

Q: Would there be two translations for the same internal machine if different address was used?

In the case above, you would have potentially mutiple xlates created on the PIX. One for the TCP/25 traffic and others for the outbound traffic.

Hope this helps.

Scott

[g.leonard]

Cheers Scott

I will try using the global to the interface. Just to clarify do you think that there would be a problem if a machine had more than one xlate on the PIX?

Gary

[scoclayton]

hard to answer your question because it really depends. Remember that statics get a higher priority when searching for xlate's that anything else (except nat 0 access-list). In your scenerio, this will not be a problem. Good luck.

Scott