topic Re: Need help with PAT translation in Network Security

Need help with PAT translation

mike.feeney — Mon, 11 Mar 2019 10:36:23 GMT

I need to do a PAT translation for SMTP. I have a 3rd party company filtering mail for us. I only want to accept mail from there IP on our ASA. Do I need to create a PAT and an ACL?

Also, when I try and set the PAT up I get an error message. The 3rd party company gave me a range of ip addresses (208.65.144.0/21). I?m trying to translate that to my exchange server. The command I am using is ? static (outside,inside) tcp 10.132.13.27 smtp 208.65.144.0 smtp netmask 255.255.248.0

Can I not map a range of outside to a single inside?

Thanks for any help you can give me.

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 13:27:44 GMT

You need to use a single address and your static is written wrong.

static (inside,outside) tcp 208.65.144.x smtp 10.132.13.27 smtp netmask 255.255.255.255

access-list outside_access_in permit tcp host <3rd.party.ip> host 208.65.144.x eq smtp

access-group outside_access_in in interface outside

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 13:35:20 GMT

Thanks for your response.

How can I take that range of ip addresses and make this work?

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 13:40:09 GMT

I'm not sure I understand. They are going to send you mail to every address in that whole subnet?

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 13:55:15 GMT

I'm not sure why they gave me a range.

What is I create the pat to look like this-

static (inside,outside) tcp 0.0.0.0 smtp 10.132.13.27 smtp netmask 255.255.255.255

Then set the ACL up to only allow the ISP range to use port 25.

Will that work?

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 14:02:16 GMT

No way, that will not work.

Is 208.65.144.0/21 your range of ip's or is this the range of ip's where your 3rd party will send you mail from?

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 14:11:33 GMT

Sorry, I didn't mean to say ISP. I meant the 3rd party for mail.

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 14:19:48 GMT

Sorry Mike, it just makes no sense to me. I would start by getting back to them and find out what the deal is. You cannot translate a single inside server address to multiple outside addresses.

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 14:24:49 GMT

How about translating the ip address of the outside interface?

static (inside,outside) tcp 12.104.x.x smtp 10.132.13.27 smtp netmask 255.255.255.255

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 14:28:36 GMT

That will work fine. Actually it would look like this...

static (inside,outside) tcp interface smtp 10.132.13.27 smtp netmask 255.255.255.255

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 14:32:43 GMT

Thank you.

From there can I create an acl to only allow the 3rd party to access port 25?

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 14:34:11 GMT

Sure...

access-list outside_access_in permit tcp host <3rd.party.ip> host 12.104.x.x eq smtp

access-group outside_access_in in interface outside

Please rate helpful posts.

Re: Need help with PAT translation

mike.feeney — Wed, 27 Jun 2007 14:39:07 GMT

Thanks again. I really appreciate all your help.

Re: Need help with PAT translation

acomiskey — Wed, 27 Jun 2007 14:41:03 GMT

No problem, hope everything works out.