topic Re: ASA STATIC NAT ISSUE in Network Security

ASA STATIC NAT ISSUE

arumugasamy — Mon, 11 Mar 2019 19:04:34 GMT

Pros,

ASA firewall with 3 zones inside,outside,dmz are configured. The front end email server in dmz was natted to the public IP (static NAT) and MX record also updated.

The firewall outside IP is x.x.x.171 (Public)

Email Nated IP address x.x.x.170 (Public)

show xlate shows global x.x.x.170 local y.y.y.12

y.y.y.12 is email front end server in dmz.

nat(dmz) 1 0.0.0.0

global (ouside) 1 interface

static (dmz,outside) x.x.x.170 y.y.y.12 netmask 255.255.255.255.

ACL applied in outside with required ports are opened.

The issue is that the user get the email and the header shows that it received with public IP x.x.x.171 of firewall outside interface instead of the MX record IP of x.x.x.170.

How can we solve this issue.

sami

Re: ASA STATIC NAT ISSUE

syedmubarakahmed — Thu, 04 Nov 2010 05:46:40 GMT

Hi Sami,

It looks like the issue of Source NAT vs Destination NAT. You have not mentioned the version of your software.

Adding the following line should fix this for you.

static (outside,dmz) y.y.y.12 x.x.x.170 netmask 255.255.255.255

Cheers,

Mubarak

Re: ASA STATIC NAT ISSUE

arumugasamy — Thu, 04 Nov 2010 07:37:46 GMT

Syed,

Should I remove the current static nat and then apply yours and test the status?

Re: ASA STATIC NAT ISSUE

syedmubarakahmed — Thu, 04 Nov 2010 08:45:01 GMT

No don't remove existing NAT. Add this one as well.

Re: ASA STATIC NAT ISSUE

Jennifer Halim — Thu, 04 Nov 2010 10:45:16 GMT

Syed, this is incorrect, you shouldn't need to add the following line:

static (outside,dmz) y.y.y.12 x.x.x.170 netmask 255.255.255.255

Arumugasamy, the existing static NAT statement is already sufficient:

static (dmz,outside) x.x.x.170 y.y.y.12 netmask 255.255.255.255

Please kindly perform a "clear xlate" to clear existing connection. You might be using the .171 earlier before configuring the static NAT statement therefore it still uses .171 for outbound mail (as you have nat/global pair statements) for outbound traffic.

Re: ASA STATIC NAT ISSUE

syedmubarakahmed — Wed, 16 Feb 2011 04:16:01 GMT

Hi,

You can try creating a more specific NAT to achieve this for outbound traffic.

nat(dmz) 2 y.y.y.12 255.255.255.255

global (ouside) 2 x.x.x.170 netmask 255.255.255.255

Thanks,