asked on

PIX NAT based on port issues

Okay, so here is the goal:

mail.domain.com is set as a public IP, let's say 1.1.1.1

Inside the network, I am using a Sonicwall appliance in front of an SME mail server.

What I want is for outside requests for 1.1.1.1 on port 25 to use NAT to send the traffic to the Sonicwall for spam/av filtering. When requests for 1.1.1.1 come in on port 80 or 443, I want NAT to send those to the SME server for webmail.

What I have done so far is gone into the ASDM and set up a Static Policy in NAT to map 1.1.1.1 to the Sonicwall. This works fine as long as I leave protocol on IP. When I try to change the protocol to TCP port 25, the NAT stops working.

I tried to leave the above rule using IP and then create a second one to NAT port 443 traffic on 1.1.1.1 to the SME server and then simply place that rule higher in importance than the other Static Policy, but, again, whenever I change protocol from IP to TCP 443, the NAT stops working completely.

Any ideas? As you can guess, I am not very well versed in PIX or using NAT in it.

shuyun111

It sounds like you want to use one outside IP Address for two inside destinations. To do that with the ASDM in the NAT Rules you have to define the service for each rule. IE.

Enable Port Address Translation
TCP
Original Port: 25
Translated Port: 25

You will have to have a rule for each service you want to use (25, 80, 443) even if two of the ports go to.

Telstar-Networks

ASKER

When I add those configuration options to the static policy rule and try to apply it errors and deletes the rule.

Changed IPs, of course. 1.1.1.1 is public IP and 2.2.2.2 is internal

[ERROR] static (inside,outside) tcp 1.1.1.1 443 access-list inside_nat_static_3 tcp 0 0 udp 0
       mapped-address conflict with existing static
inside:2.2.2.2 to outside:1.1.1.1 netmask 255.255.255.255
Usage: [no] static [(real_ifc, mapped_ifc)]
            {<mapped_ip>|interface}
            {<real_ip> [netmask <mask>]} | {access-list <acl_name>}
            [dns]
            [[tcp] <max_conns> [<emb_lim> [<norandomseq> [nailed]]]]
            [udp <max_conns>]
      [no] static [(real_ifc, mapped_ifc)] {tcp|udp}
            {<mapped_ip>|interface} <mapped_port>
            {<real_ip> <real_port> [netmask <mask>]} |
            {access-list <acl_name>}
            [dns]
            [[tcp] <max_conns> [<emb_lim> [<norandomseq> [nailed]]]]
            [udp <max_conns>]
      show running-config [all] static [<mapped_ip>]
      clear configure static

ASKER CERTIFIED SOLUTION

shuyun111

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Telstar-Networks

ASKER

Ahh, that was stupid of me. Got it working, thanks. The ASDM interface is kind of counter intuitive on this one. Thanks for your help.

shuyun111

Thanks, glad to see that you got it going.