Blackberry Servers behind 1811 Router/Firewall

[IM-Design]

Hi,

I have a 1811 router on which I am using the firewall feature set. We currently have one blackberry enterprise server (server1=192.168.0.2 LAN, xx.yy.zz.230 WAN) in the LAN behind this firewall which is functioning well.

We would like to add a 2nd blackberry server (server2=192.168.0.3 LAN, xx.yy.zz.231 WAN) for a separate domain.

The blackberry Enterprise server docs indicate that port 3101 TCP is the one that needs to be open between the BES and the WAN. The BES opens this port outbound and maintains the TCP connection.

Here is the current relevant ACL line:

access-list 102 permit tcp any host xx.yy.zz.230 eq 3101

I am thinking I need to change this to:

access-list 102 permit tcp any any eq 3101

I am also NATting that port to the existing BES machine, so I believe I will have to remove this nat statement as well

ip nat inside source static tcp 192.168.0.2 3101 interface FastEthernet0 3101

What I am expecting is that these changes will permit both of these Blackberry Enterprise Servers to communicate with the blackbryy infrastructure in order to push email to devices in their respective domains.

Could anyone confirm that the changes I am proposing are correct given the intended goal?

[a.cruea1980]

permit tcp any any eq 3101 is, in my opinion, just a little too wide of acceptance.

Why not just have two lines? the original, then add another? just use host xx.yy.zz.231.

Also, if you don't have a NAT statement, traffic won't get to your BES server. In your case, instead of saying "interface fa0 3101", you'll have to specify the two addresses.

I think it's along the lines of "ip nat inside source stat tcp 192.168.0.2 3101 xx.yy.zz.230 3101" and then a second NAT statement, "ip nat ins sour stat tcp 192.168.0.3 3101 xx.yy.zz.231 3101".

That should work for you. And you'll have to remove your current NAT statement, yes.