How do I set my PIX to send SMTP from a different external IP?

I have a block of external IPs on the outside of my PIX.  All traffic from the inside headed out goes through my default IP (lets say 1.1.1.1) but I want to send SMTP traffic through a different IP, 1.1.1.2.  How do I configure my PIX to send just SMTP traffic through that IP?
solidisquadAsked:
Who is Participating?
 
batry_boyConnect With a Mentor Commented:
You have to use policy NAT...something like this:

access-list smtp-only permit tcp any any eq smtp
nat (inside) 10 access-list smtp-only
global (outside) 10 1.1.1.2

Just make sure that you use a different sequence number for your nat and global statements than you already have defined for your other outbound traffic and make sure they match (in this example, I used "10" to identify the nat and global statements to be used for the outbound SMTP traffic).

The statements above should work for ANY inside host sending outbound SMTP.  If you want to lock this down to a specific mail server on the inside, then you could put in the inside IP address of that mail server in the access list as shown below:

access-list smtp-only permit tcp host 192.168.1.20 any eq smtp
nat (inside) 10 access-list smtp-only
global (outside) 10 1.1.1.2

In the above example, only the SMTP traffic originating from inside host 192.168.1.20 will be translated to 1.1.1.2 once it passes through the firewall.  Any other outbound SMTP traffic will still use the global PAT address (1.1.1.1 from your post).
0
 
solidisquadAuthor Commented:
Awesome, thanks for your help!  I haven't done a Static NAT in that direction before, but that certainly makes sense.  I'll let you know once I've tested it.
0
 
Ernie BeekExpertCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
All Courses

From novice to tech pro — start learning today.