STATIC NAT TRANSLATION TO VLAN TWO HOPS FROM ROUTER

[nicholasgondwe]

Hi

I have a Cisco 1841 router connected to the ISP and I have the LAN side of the router connected to an ASA5510. The ASA5510 is in turn connected to a catalyst switch with 6 VLANs configured on it. The ASA5510 has subinterfaces which are connected to the switch and it is doing intervlan routing as well. The ASA also is doing DHCP for each VLAN and is working fine and the VLANs can reach the internet. One of the VLANs has a mail server. The ROUTER is the one doing NAT and there is NO NAT on the ASA and I do not want any NAT there.

My problem is how can I forward incoming  mail from the internet to my mail server sitting in the VLAN behind the ASA when the NAT is being done on the router connected to the ISP. The mail server is seperated by the ASA which sits between the switch and the router. Please help.

[Mohamed Sobair]

Hi,

You still nat exemption on the ASA in order not to translate inside hosts accessing Internet, along with that , you need to make sure that (NO nat-control) is configured and its the default behaviour of ASA.

Now, once that is done, on the router you can easily perform the NAT for the mail server direct IP Address, you should have a route in this case in the router for the mail server and Internal subnet pointing to the ASA outside Interface.

HTH

Mohamed