Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Translation issues, affecting failover testing

What is the best setup for the following scenario? The only traffic permitted inbound is smtp to mail server. This is done using port redirection to internal mailserver:

static (inside,outside) tcp interface smtp X.X.X.X smtp netmask 255.255.255.255 0 0

Outbound traffic initiated by 4 servers. One of which is mail server. Would you be able to use a seperate address to the outside interface for the mail server to use when initiating outbound traffic or would you have to use a static to the same address as the interface. Would there be two translations for the same internal machine if different address was used?

What would be the best way to do this? 2 of the machines really need a static mapping as they would be initiating traffic regularly. The other machines only would initiate traffic once a day for example. However if a static mapping to the interface was used I would get all traffic to the interface forwarded to the mail server. ACLs could block this but in my experience this would add loads of messages to syslog and affect failover testing.

3 REPLIES

Re: Translation issues, affecting failover testing

Hi,

Let me try to answer your questions in a QA format below.

Q: Would you be able to use a seperate address to the outside interface for the mail server to use when initiating outbound traffic or would you have to use a static to the same address as the interface?

A: Well, sither one of these (sort of) would work. In most cases, people just add something like this to the config to allow the internal server to initiate conns outbound:

nat (intf) 2

global (outside) 2 interface

Q: Would there be two translations for the same internal machine if different address was used?

In the case above, you would have potentially mutiple xlates created on the PIX. One for the TCP/25 traffic and others for the outbound traffic.

Hope this helps.

Scott

New Member

Re: Translation issues, affecting failover testing

Cheers Scott

I will try using the global to the interface. Just to clarify do you think that there would be a problem if a machine had more than one xlate on the PIX?

Gary

Re: Translation issues, affecting failover testing

hard to answer your question because it really depends. Remember that statics get a higher priority when searching for xlate's that anything else (except nat 0 access-list). In your scenerio, this will not be a problem. Good luck.

Scott

88
Views
0
Helpful
3
Replies
CreatePlease login to create content