Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Cisco ASA 5510 I currently have a NAT for SMTP on one outside IP to an internal IP. I need to setup 2 external IPs to NAT to the same IP internally. How can I do that? ex: 25 --> 25 25 --> 25

share|improve this question
What external IP do you want the internal one to respond with through the firewall? Are you needing PAT? Expound on what you are trying to accomplish (multiple ISPs, separating apps, etc.). – TheCleaner Dec 20 '12 at 19:24
Could you elaborate on why you want to do this? It would be easier to multi-home your SMTP server and create a 1-to-1 nat for each of its two addresses... – 1.618 Dec 20 '12 at 19:25
One outside IP currently points to spam filter and another IP points to Exchange. I want both IPs to point to spam filter. I just changed providers and firewalls. My old firewall allowed this function and wasn't changing the setup really, unless I have to. – Keith Dec 21 '12 at 3:49
up vote 4 down vote accepted

You won't be able to use static PAT for this as you would break the 1:1 mapping rule. Firewall has to know what mapping to use in both directions - both in->out and out->in. In your case if originated connection from port 25 firewall would not know which global IP to use. In other words, it's not possible this way.

Easiest solution would be to assign additional IP address on the internal device and keep the NATs clean. Let's say you assign additional IP of Configuration would be:

static (inside,outside) tcp 25 25
static (inside,outside) tcp 25 25
share|improve this answer
This worked for me. Straight forward and I should have thought of that too. ;) Thanks for your help. – Keith Dec 21 '12 at 14:36

With IOS 8.2 or bellow:

access-list SMTP-Services extended permit ip host host
access-list SMTP-Services2 extended permit ip host host

static (InternalInterface,ExternalInterface) access-list SMTP-Services
static (InternalInterface,ExternalInterface) access-list SMTP-Services2

Sorry, I had understood the exact opposite of what you wanted to do.

Don't forget to add an access-list on your External Interface.

access-list _outside-in_ extended permit tcp host host _YourExternalIP_ eq smtp
access-list _outside-in_ extended permit tcp host host _YourExternalIP_ eq smtp
share|improve this answer
There are two things, one I made a slight mistake (see edit) you need two different access-lists. Also, I think you are mixing up the IPs. When you do a static you have to make it as if your local IP wanted to NAT going outside. Since it's a static NAT, when the external IP hits your ASA, it will translate it to the local IP. – Alex Dec 21 '12 at 4:07
It would also help to know what version of IOS you are running with a show version because between IOS 8.2 and IOS 8.3, NAT configuration has change a lot. – Alex Dec 21 '12 at 4:20
8.2 Thanks for your help. – Keith Dec 21 '12 at 14:35

First you will need to upgrade to ASA post-8.3. Create and object network with the range of IPs for the public. Then create an object network for the inside/real IP address of the server. Then add a nat statement calling the first object.

object network outside_email

object network inside_email
 nat (inside,outside) static outside_email
share|improve this answer

There is this same quesiton on another Stack Exchange site here. This works because the protocol, source ip, destination ip and port are all part of the key for this 1:1 mapping. It's also a great technique for network resilience if BGP is out of grasp.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.