Hi, I am looking for help with my NAT configuration on Cisco ASA 5516-x with Firepower services connected to FMC.
Our local subnet LOCAL.NET.0.0/16 already has an Internet connection, with public IP XX.X.228.50. To obtain it I created typical Dynamic NAT:
object network lan_local_LOCAL.NET.0.0-16
nat (inside,outside) dynamic interface
Also, I created a NAT rule to reach the Exchange server from outside:
nat (outside,inside) source static any interface destination static IP_XX.X.228.54 MX2_LOCAL.NET.0.21 service SVC_30064789002 SVC_30064789002
nat (outside,inside) source static any interface destination static IP_XX.X.228.54 MX2_LOCAL.NET.0.21 service SVC_30064789003 SVC_30064789003
nat (outside,inside) source static any interface destination static IP_XX.X.228.54 MX2_LOCAL.NET.0.21 service SVC_30064789004 SVC_30064789004
It works as it should. As you admit we use different IP addresses for Internet access and for Exchange server. Outside IP for Internet Access is: XX.X.228.50
Outside IP for Exchange server: XX.X.228.54
Now we need to create NAT rule, to NAT all outside traffic of Exchange server to XX.X.228.54 instead of XX.X.228.50, and when I create one, for example
object network MX2_LOCAL.NET.0.21
nat (inside,outside) dynamic IP_XX.X.228.54
It works, but time to time, some packets NATed to this rule, some packets NATed to main local net NAT rule:
object network lan_local_LOCAL.NET.0.0-16
nat (inside,outside) dynamic interface
I checked it, by looking to the public IP address in web-browser and pressing F5 button, in 50% cases Public IP is XX.X.228.54 but in other XX.X.228.50. This is the issue, it prevents to work of our mail server correctly.
How to handle this issue? How to freeze public IP for the Exchange server?
