topic why you need to create in Network Security

ASA secondary IP address configuration

Izac ICT — Tue, 12 Mar 2019 08:18:54 GMT

Dear all,

I have Asa5510 and 8 public IP addresses. I want to configure NAT to my second exchange server but how can I do that?

Currently Outside interface configured like that:

xxx.xxx.xxx.123

255.255.255.248

ISP router is xxx.xxx.xxx.121

When I try to create sub interface(xxx.xxx.xxx.126) it gives error that "The IP address, xxx.xxx.xxx.126/ 255.255.255.248, cannot overlap with the subnet of interface Outside".

I want to map my second exchange server to smtp and https ports.

Thank you very much in advance for your help.

Kind regards,

IZac

why you need to create

Pawan Raut — Fri, 23 Sep 2016 10:13:57 GMT

why you need to create another interface for NAT?

do you want NAT exchange server smtp and https with xxx.xxx.xxx.126 ?

because currently smtp and

Izac ICT — Fri, 23 Sep 2016 10:48:56 GMT

because currently smtp and https ports are forwarded my first exchange 2013 server. I want to have faileover. IF something happens to exch1 there is no email access.

If I forward https and smtp also to exch2 somehow then it wont be problem.

I want to have e-mail failover.

Stll I cat get you what you

Pawan Raut — Fri, 23 Sep 2016 10:52:41 GMT

Stll I cat get you what you want to achieve here do you want NAT exh2 with new Public IP xxx.xxx.xxx.126 ?

Yes. How can I do that?

Izac ICT — Fri, 23 Sep 2016 11:04:18 GMT

Yes. How can I do that?

I want to access both servers externally.

Here you go. Let consider

Pawan Raut — Fri, 23 Sep 2016 11:16:05 GMT

Here you go. Let consider your exchange2 server internal IP is 10.1.1.1 and external Public IP you want to do NAT is 20.1.1.1

ASA(config)# object network exchang2
ASA(config-network-object)# host 10.1.1.1
ASA(config-network-object)# nat (inside,outside) static 20.1.1.1 service tcp smtp https

Do you think it won`t effect

Izac ICT — Fri, 23 Sep 2016 11:21:38 GMT

Do you think it won`t effect the Exch1? Should add also firewall rules?

It will not impact exch1

Pawan Raut — Fri, 23 Sep 2016 11:39:53 GMT

It will not impact exch1 communication as you are using different NAT IP for exch1 and exch2. Yeah you need FW rule as well

Thank you very much, it

Izac ICT — Fri, 23 Sep 2016 12:07:37 GMT

Thank you very much, it worked. I only directly maped https to https and smtp to smtp

ASA(config)# object network exchang2
ASA(config-network-object)# host 10.1.1.1
ASA(config-network-object)# nat (inside,outside) static 20.1.1.1 service tcp smtp smtp

ASA(config)# object network exchang2https
ASA(config-network-object)# host 10.1.1.1
ASA(config-network-object)# nat (inside,outside) static 20.1.1.1 service tcp htpps https