NAT for Tacacs Servers

Question

could anyone tell me if it is possible to NAT authentication requests for a specific TACACS server to an alternative address, which would be a new TACACS server - all device subnets have direct connections to a PIX firewall
eg:  network devices on 10.50.X.X authenticate to 10.51.20.100.   I want any device destined for 10.51.20.100 using port 49 to translate to 192.168.1.100.
I have tried numerous ways to achieve this but I think the problem is that they all have direct connections to the firewall and therefore it will never get translated.  Please see attached diagram.
many thanks

Answer 1

Using 'add destination service' in the group rule NATs the original client IP as the VIP (in your case), and ensures that return traffic from the remote 20.x.x.x servers flows back to the CSS and then to the client instead of directly to the client (which would reject the traffic). There's no need to worry about any kind of load balancing loop being created. The downside to implementing this is that your servers will see all traffic as originating from the VIP and not the unique client IPs, and since the CSS doesn't support the x-forwarded-for header you're kinda stuck with that side effect.
Also, it's my understanding that the group rule must match the content rule in terms of VIP address and services within it to be effective. You would need to change your group rule to the following for it to work:
FROM:
group Gateway
  vip address 61.61.61.61
  add destination service 20.1.1.1
  add destination service 20.1.1.2
  active
TO:
group Gateway
  vip address 61.61.61.61
  add destination service 10.1.1.1
  add destination service 10.1.1.2
  add destination service 20.1.1.1
  add destination service 20.1.1.2
  active
Good luck!
James