ASA mail flow with 2 ISP

[Lee Dress]

I have 2 ISPs that feed my ASA 5516.

I have a NAT that routes incoming mail from one ISP to the mail gateway.  this weekend that circuit went down so no mail was flowing in.

I'd like to be able to add a nat from the other ISP to the mail server.

is it possibly that simple that i just need to add a nat and access rule?  I'm not concerned about outbound mail. just inbound

I have the ability to make a second MX record in DNS. so if the first mx record doesn't respond mail will route to the second mx record.

[Kias]

Is it something similar to this?

https://supportforums.cisco.com/t5/security-documents/dual-isp-implementation-on-asa/ta-p/3144475

[Karsten Iwen]

That's quite easy. If you already have two default-routes (with different ADs) to both ISPs, then it's just a second static NAT-entry and ACE for the second ISP.

[Spooster IT Services · Accepted solution]

Hi  Lee Dress,

You need to setup two NAT rules and then allow access to private IP of mail server in access-list (if you are using two access-list for each ISP then in both and if single access-list then in that one only). 

Then you need to setup two  MX record in DNS.

Following is the sample configuration:-

Let's say "OUTSIDE" & "OUTSIDE2" are the two nameif's for ISP facing interfaces.

nat (INSIDE,OUTSIDE) source static  <Private IP of mail server> <ISP1 routeable IP>
nat (INSIDE,OUTSIDE2) source static  <Private IP of mail server> <ISP2 routeable IP>
access-list OUTSIDE-ACCESS-IN extended permit tcp any4 <Private IP of mail server> eq 25

[Lee Dress]

Thanks for the help.

I didn't think it was going to be that simple.

I assumed I would get barked at by the asa for having 2 rules with the same protocol.

All done. I just need to setup the second mx record in external DNS