Hi,
Ok, so if you want to perform Static PAT for port TCP/25 only to enable inbound traffic from Internet then you would need configurations like these
Example source information
- Interfaces "inside" and "outside"
- External IP addresses 1.1.1.2 and 1.1.1.3 of which 1.1.1.2 is the one configured on the "outside" interface
- Internal IP addresses 10.10.10.2 and 10.10.10.3
- ACL attached to "outside" interface is called OUTSIDE-IN
static (inside,outside) tcp interface 25 10.10.10.2 25 netmask 255.255.255.255
static (inside,outside) tcp 1.1.1.3 25 10.10.10.3 25 netmask 255.255.255.255
access-list OUTSIDE-IN remark Allow inbound SMTP traffic
access-list OUTSIDE-IN permit tcp any host 1.1.1.2 eq 25
access-list OUTSIDE-IN permit tcp any host 1.1.1.3 eq 25
access-group OUTSIDE-IN in interface outside
Only use "access-group" command if you dont have any ACL configured for "outside" interface. If you have an ACL then use its name in the above ACL configurations and dont add any additional "access-group" command.
The above configurations should enable external SMTP connections to these 2 public IP addresses.
Incase you need both servers outbound connections to show with the same IP addresses as in the Static PAT configurations you need additional NAT configurations. What I mean is if you want the connections initiated from the servers to the external network to show up with the same IP addresses then you will need something like this
access-list SMTP-SRV-1-POLICYPAT remark Dynamic Policy PAT for SMTP Server 1
access-list SMTP-SRV-1-POLICYPAT permit tcp host 10.10.10.2 any eq 25
access-list SMTP-SRV-2-POLICYPAT remark Dynamic Policy PAT for SMTP Server 2
access-list SMTP-SRV-2-POLICYPAT permit tcp host 10.10.10.3 any eq 25
global (outside) 100 interface
nat (inside) 100 access-list SMTP-SRV1-POLICYPAT
global (outside) 200 1.1.1.3
nat (inside) 200 access-list SMTP-SRV-2-POLICYPAT
The above ACLs defines the condition when this translations should be done. The "global" and "nat" perform the actual NAT/PAT.
I would imagine that you might not need the ID 100 rule since you probably already PAT outbound traffic to it but it might be clearer to read the configuration when both servers had their own configurations still.
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed though.
- Jouni
