Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Going to try and explain this the best I can..

I have 2 public IP addresses. my cisco asa is configured with a NAT that assigns my exchange server 1 of the IPs, everything else gets the other IP.

I have exchange 2007, win2k8ex1 which has a NAT rule inside a cisco ASA that translates all communication through a static public IP (well say x.x.x.1)

I then have my domain controller with all the other systems that use x.x.x.2

I am currently upgrading to exchange 2010, on the inside everything is fine, I havent migrated mailboxes or anything yet. But I set up the legacy, autodiscovery, mail, and owa records accordingly on the inside dns (legacy is the only thing that points to exchange07) and it works fine.

I wanted to migrate users in groups over the next week.

Looking at the ASA, is it possible to have both of these servers talk through the same public ip using the NAT rules? I can only configure it to use one server at a time on the exchange-outside-ip (x.x.x.1)

im hoping i explained this well enough


share|improve this question
Not sure what you mean by "is it possible to have both of these servers talk through the same public ip using the NAT rules?". Both exchanges can be mapped to the same public IP for NAT, but for portwarding/PNAT/Destination NAT it will not work (unless you use non standard ports for one of them). – 3molo Mar 22 '11 at 18:44
thats what i was figuring - i think im going to just have to plan a giant migration all at once instead of spacing it out like I was hoping to accomplish – Jeff Mar 22 '11 at 18:54
up vote 1 down vote accepted

You'll want to set up Exchange 2010's Edge Transport Role (and possibly Client Access Service Role) on a server using that one IP for outside access/transfer.

Edit: Hub Transport can be used in place of Edge Transport if you're feeling squirrely.

Edit 2/3: There's a guide to CAS proxying from Microsoft at the following link:

share|improve this answer
I don't have the ability to get another server for the edge transport. i have the client access, hug transport, and mb server roles on the same server. we dont use edge transport on either system, we have an outside spam filter that basically does the same thing, but we don't manage it – Jeff Mar 22 '11 at 18:54
Then just run Hub Transport and Client Access on it. The only conceivable reason to connect straight to 2007 from the Internet once you have 2010 running is for client access, with CAS should nicely take care of. – Hyppy Mar 22 '11 at 18:58
hyppy - so, if i have the hub transport and client access installed on my new server, and i just change the NAT rule to point to the new server instead of the. create the on my outside dns as well, that even if a mailbox is still located on the 2007 server, the 2010 CAS role will still route the messages accordingly and everything should work? – Jeff Mar 22 '11 at 19:02
Hub Transport is what will route the messages to mailboxes within your organization. CAS is just for client access (OWA, Outlook, etc) – Hyppy Mar 22 '11 at 19:07
right - so basically all that is needed to access the outside is the hub transport on exchange 2010, and it will route the mailflow to the exchange 2007 mail boxes – Jeff Mar 22 '11 at 19:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.