ASA 5505 (8.3+): Problems getting internal server NAT'd properly

Question

I have an internal VOIP voicemail/presence server I want accessible from outside my internal network. Connecting internally works great, but when a user tries connecting from outside, there's no availability. When I try to use NAT, the voicemail-to-email service can't reach our cloud email service.
We have a /28 public IP address range. The ASA is our external device, the WAN side is .220, with our ISP's gateway set at .222. I've tried NATting the server to a .217 address, but that's when things go wrong.
With the current config, our VM-to-email works. Here's some snippets of my config:
ASA Version 9.0(3) 
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.200.1 255.255.255.0 
interface Vlan2
 nameif outside
 security-level 0
 ip address xxx.xxx.xxx.220 255.255.255.248 
object network OUTSIDE
 host xxx.xxx.xxx.220
object network INSIDE
 subnet 192.168.200.0 255.255.255.0
object network VMSERVER
 host 192.168.200.59
object network VMSERVER_PUBLIC
 host xxx.xxx.xxx.217
object service VMSERVER_Bitmessage
 service tcp source eq 8444 destination eq 8444 
 description Bitmessage
object service VMSERVER_XMPP_client
 service tcp source eq 5222 destination eq 5222 
 description Extensible Messaging and Presence Protocol (client)
object service VMSERVER_XMPP_server
 service tcp source eq 5269 destination eq 5269 
 description Extensible Messaging and Presence Protocol (server)
object service VMSERVER_HTTP
 service tcp source eq 8080 destination eq 8080 
object-group service VMSERVER
 service-object object VMSERVER_Bitmessage 
 service-object tcp-udp destination eq 5222 
 service-object tcp-udp destination eq 5269 
 service-object object VMSERVER_HTTP
access-list INBOUND extended permit object-group VMSERVER any4 object VMSERVER 
no arp permit-nonconnected
nat (inside,outside) source static VMSERVER VMSERVER destination static OUTSIDE OUTSIDE service VMSERVER_XMPP_client VMSERVER_XMPP_client no-proxy-arp
nat (inside,outside) source static VMSERVER VMSERVER destination static OUTSIDE OUTSIDE service VMSERVER_XMPP_server VMSERVER_XMPP_server no-proxy-arp
nat (inside,outside) source static VMSERVER VMSERVER destination static OUTSIDE OUTSIDE service VMSERVER_Bitmessage VMSERVER_Bitmessage no-proxy-arp
nat (inside,outside) source static VMSERVER VMSERVER destination static OUTSIDE OUTSIDE service VMSERVER_HTTP VMSERVER_HTTP no-proxy-arp
object network INSIDE
 nat (inside,outside) dynamic interface
access-group INBOUND in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.222 1
It seems to me that it's a NAT issue, but I could be wrong. If I try adding a static route for the public address for the server, the VM-to-email stops working. And, the presence server still doesn't work externally.
Any help is appreciated,
LaneR

Answer 1

Packet tracer output to mapped (public) address:
ASA# packet-tracer input outside tcp 1.1.1.1 8080 xxx.xxx.xxx.217 8080 detailed
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
object network VMSERVER
 nat (inside,outside) static xxx.xxx.xxx.217
Additional Information:
NAT divert to egress interface inside
Untranslate xxx.xxx.xxx.217/8080 to 192.168.100.59/8080
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group INBOUND in interface outside
access-list INBOUND extended permit tcp any any eq 8080
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcd332f78, priority=13, domain=permit, deny=false
        hits=1, user_data=0xc922afc0, cs_id=0x0, use_real_addr, flags=0x0, proto
col=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=8080, tag=0 dscp=0x0
        input_ifc=outside, output_ifc=any
Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xc7668a30, priority=1, domain=nat-per-session, deny=true
        hits=1294404, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x
0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=any, output_ifc=any
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcb250c18, priority=0, domain=inspect-ip-options, deny=true
        hits=837081, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=outside, output_ifc=any
Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcbbc8378, priority=13, domain=ipsec-tunnel-flow, deny=true
        hits=697, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=outside, output_ifc=any
Phase: 7
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
object network VMSERVER
 nat (inside,outside) static xxx.xxx.xxx.217
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xcd333dc0, priority=6, domain=nat-reverse, deny=false
        hits=3, user_data=0xcaaa0950, cs_id=0x0, use_real_addr, flags=0x0, proto
col=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=192.168.100.59, mask=255.255.255.255, port=0, tag=0 dscp=0x0
        input_ifc=outside, output_ifc=inside
Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xc7668a30, priority=1, domain=nat-per-session, deny=true
        hits=1294406, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x
0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=any, output_ifc=any
Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xcb227388, priority=0, domain=inspect-ip-options, deny=true
        hits=858219, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=inside, output_ifc=any
Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 856605, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
Actually using a browser and port 8080, no access...