|However, I find that the ADSL NAT does not work, which I believe is because |their mail gateway routes the reply traffic through the active VRRP, so the |sending mail server breaks the connection, because it gets responses from a |different IP address that it initiated the connection.
Asymmetric routing occurs in this situation and any stateful firewall or a TCP based application (like SMTP) will deny this connection. ADSL connection should only be used after the primary connection fails. Why are you trying to use ADSL while the primary production connection is still up? Asymmetric routing issue will resolve by itself after the primary connection fails. I assume MX records were setup using the different priority values? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Giles Coochey Sent: Wednesday, August 01, 2007 10:12 AM To: [email protected] Subject: [c-nsp] VRRP, NAT issue for incoming connections Hi, I have a customer who has two connections, one ADSL and one leased-line connection, both are for Internet access. They use NAT on both of these connections, and VRRP on the inside interfaces to detect a failure. ADSL is set as the backup interface while the leased-line connection is the active one. They also have inbound NAT for port 25 (SMTP) to their mail gateway, to accept incoming mail, and they have set up MX records for both IPs on their ADSL & leased-line. However, I find that the ADSL NAT does not work, which I believe is because their mail gateway routes the reply traffic through the active VRRP, so the sending mail server breaks the connection, because it gets responses from a different IP address that it initiated the connection. Any ideas on a solution to this? I'm thinking of something like reverse NAT to specific internal IP addresses to bypass the VRRP issue... but I'm unsure of whether I can NAT on only TCP/25 traffic... The platforms are low end, routers are an 850 and 1841. Appreciate any ideas you may have. |------------| | | |-----| | Internet |---------|Mail | | | |Svrs | |------------| |-----| | | NAT->x | | NAT->y 850 1841 | VRRP | |----------- | |-----| |Mail | |Svr | |-----| _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
