Exchange server using interface IP after migrating from 8.2 to 9.1

Question

hi,
i recently upgraded an ASA pair from 5510 (ASA OS 8.2) to 5512 (ASA OS 9.1). Many of the services are working fine including VPN after some tweaking and modifications in the new configuration, however the exchange server is not sending the traffic from its designated public IP which is mentioned in NAT statements. Exchange is using the public interface IP of the firewall for outbound communication. If i try to telnet from outside to the public IP addresses of the exchange server its giving proper response. kindly help me with this issue. i believe this is some NAT related issue.
OLD configuration (relevant part only)
access-list out_in extended permit tcp any host 213.42.201.35 eq www 
access-list out_in extended permit tcp any host 213.42.201.35 eq https
access-list out_in extended permit icmp any host 213.42.201.35
access-list out_in extended permit tcp any host 213.42.201.35 eq smtp 
static (DMZ,outside) tcp 213.42.201.35 www 172.16.2.200 www netmask 255.255.255.255
static (inside,outside) tcp 213.42.201.35 https 192.168.190.57 https netmask 255.255.255.255
static (DMZ,outside) 213.42.201.35 172.16.2.11 netmask 255.255.255.255
access-list out_in extended permit tcp any host 213.42.201.34 eq smtp 
static (DMZ,outside) 213.42.201.34 172.16.2.21 netmask 255.255.255.255
New Configuraion
object network obj-172.16.2.21
 host 172.16.2.21
 description Created during name migration
object network obj-172.16.2.11
 host 172.16.2.11
access-list out_in extended permit icmp any host 172.16.2.11 
access-list out_in extended permit tcp any host 172.16.2.11 eq smtp 
access-list out_in extended permit tcp any host 172.16.2.21 eq smtp
nat (inside,outside) static 213.42.201.35 service tcp https https 
object network obj-192.168.0.0
 nat (inside,outside) dynamic interface dns
object network obj-192.168.0.0-01
 nat (inside,DMZ) dynamic 172.16.2.254 dns
object network obj_any
 nat (inside,outside) dynamic obj-0.0.0.0
object network obj_any-01
 nat (inside,DMZ) dynamic obj-0.0.0.0
object network obj-172.16.2.21
 nat (DMZ,outside) static 213.42.201.34
object network obj-172.16.2.11
 nat (DMZ,outside) static 213.42.201.35 service tcp smtp smtp 
regards
Najeeb

Answer 1

Hi Najeeb,
 If  you are able to reach out to your SMTP via Public IP address , 172.16.2.11 will be using public IP address 213.42.201.35 for mail delivery (SMTP service alone) . Server 172.16.2.21 will be using Public IP address 213.42.201.34 for any traffic including SMTP , to double check this open your IE on your 172.16.2.21 google it for what is my IP address , you will see your public ip address 213.42.201.34 on your google results .
At any point time your both server will never use your outside interface for any external communication
          The issue is exchange is sending the outgoing traffic via the outside interface of my firewall (213.42.201.46).
HTH
Sandy