Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 5 usable external static IP addresses leased by our ISP: .49 to .53, where

  • .49 is assigned to the Juniper SSG20 firewall and NATed for
  • .50 is assigned to a windows box for web server and domain controller
  • .51 is assigned to another windows box with exchange server (domain: mx record is pointing to

Currently there is a policy set for all SMTP incoming traffic addressed to .51 forward to the NATed address of the exchange server box (private IP:

We can send and receive emails for both internal and external, but the gmail is saying mails from is not sent from the same IP as the mx lookup however is from

    Received-SPF: neutral ( is neither permitted nor denied by
    best guess record for domain of;

    Authentication-Results:; spf=neutral ( is 
    neither permitted nor denied by best guess record for domain of

and the mx record in global dns space as well as in the domain controller .50 for is set to

My attempt to resolve the above issue is to

  1. Update the mx record from to
  2. Create a new VIP for SMTP traffic addressed to to forward to

After my changes incoming email stopped working, I believe it has something to do with the Juniper setting that SMTP addressed to .49 is not forwarded to

Also, I have been wondering is it mandatory to assign an external static IP address to the Juniper firewall?

Any helps appreciated.


share|improve this question
up vote 0 down vote accepted

Yes, you need a routable public address for your firewall's external interface. Your real problem is that you're doing inbound destination NAT by using VIPs and relying on the default source NAT for outbound traffic. Because of this, all traffic appears to be coming from the firewall's address.

What you're REALLY after here, is both a destination NAT for inbound traffic, and a source NAT for outbound traffic, also known as either static NAT or 1-to-1 NAT.

What you need to do, is create a MIP. Go to interfaces, click edit on your external interface, go to the MIP tab, and create an entry mapping that external address (51) to the mail server.

Follow this article:

Now... this can get a little more tricky if say you need one external IP to be used to hit two different hosts. So let's say for .51 you were going to forward 80/443 to an exchange CAS server, but SMTP to a transport server. In that case you'd have to make explicit rules for both destination AND source address translation.

share|improve this answer
Also... you could just leave your existing settings alone and create a rule to permit SMTP traffic outbound from your mail server, and in that policy tell it to SNAT the traffic as coming from .51! You would have to place the rule above the one for your existing trust to untrust traffic. – SpacemanSpiff Oct 22 '12 at 2:27
Thanks for the answer, we managed to set up a MIP using .51, however the same comment from google is still there but with the address changed to 51 instead. I think we need a PTR record for reverse lookup. – codemonkie Oct 23 '12 at 16:39
You should turn on some logging and make certain the NAT is doing what its supposed to. If you didn't adjust your rule it may still be using the inteface IP and not the MIP IP – SpacemanSpiff Oct 23 '12 at 20:54
Okay, I'll do that, thanks again. – codemonkie Oct 24 '12 at 16:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.