Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Replacing PIX with Cisco ASA 5505 issues

Posted on 2011-03-23
8
Medium Priority
?
468 Views
Last Modified: 2012-08-13
We replaced an extremely old PIX with an ASA 5505. We duplicated the old config on the new ASA (when possible) but still having a couple issues. The biggest one is that the old PIX had a rule that assigned an additional wan ip address to the outside interface.

global (outside) 1 74.x.x.12

I don't think the ASA is using that line (if at all) the way the pix did because we are having issues with some outbound email bouncing back due to our SPF record. The SPF record is set to 74.x.x.12 but when I telnet into other mail servers, they are seeing me come from 74.x.x.10 which is the IP assigned to the outside interface 0/0 of the ASA.

Any ideas how to resolve this besides changing the SPF record?
0
Comment
Question by:amkbailey
  • 4
  • 2
  • 2
8 Comments
 
LVL 13

Expert Comment

by:kdearing
ID: 35200316
Need to create a static NAT rule for your email server and 74.x.x.12
0
 

Author Comment

by:amkbailey
ID: 35200360
Here was the existing NAT rule.

access-list acl_inbound permit tcp any host 74.x.x.11 eq smtp

I added
access-list acl_inbound permit tcp any host 74.x.x.12 eq smtp

but when I telent into other mail servers, it is seeing my ip in the greeting as 74.x.x.10
0
 
LVL 13

Accepted Solution

by:
kdearing earned 1000 total points
ID: 35200483
Those are access rules, not NAT commands.

What CLI version are you running, 8.2 or 8.3?
0
Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

 

Author Comment

by:amkbailey
ID: 35200576
8.2 (1)

nat (inside,outside) tcp 74.x.x.11 smtp 10.x.x.113 smtp netmask
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 1000 total points
ID: 35201176
>nat (inside,outside) tcp 74.x.x.11 smtp 10.x.x.113 smtp netmask

This should say
 static (inside,outside) 74.x.x.11  10.x.x.113 netmask 255.255.255.255
 ^^^
0
 

Author Comment

by:amkbailey
ID: 35201450
sorry. it does. left that part off. I guess I need to post both config files to see the difference.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 35202498
It should be a 1-1 static nat, or a policy nat and not just the smtp port static.
0
 

Author Closing Comment

by:amkbailey
ID: 35244411
We ended up just going to 1 static IP so we have it working ok now.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question