Issue with VIP

Hi Everyone,

I have a problem that someone may be able to help me with / point me in the right direction. I come from a Sonicwall background so this may just be terminology that is throwing me :)

I've searched the forum and tried a few things but can't get past my VIP issue, namely that the port 25 VIP that I set up is not sent on to the mail server.

I have set up a VIP, a policy, according to the cookbook, on my 60C (4.0) with an external ip of 0.0.0.0 (it's dynamic / dhcp delivered), internal IP of my mail server (private net), port forwarding on and TCP port 25 specified in the external and map to port fields.

My policy has the source interface as wan1, source address "all", destination interface of internal and destination address my VIP. Schedule is always, service is SMTP and Action is ACCEPT (and no NAT).

Problem is nothing gets through. I can telnet from the firewall (SSH) to the mail server on port 25, but when I try it from an external internet host I see lots of "wan 1 in" records (diag sniffer packet any "tcp and dst port 25" 4) but nothing ever out to the mail server.

The mail server is on the same subnet as the firewall's internal interface, and the firewall is running in NAT mode. I can ping from the mail server to the external internet test host, so connectivity seems to be fine.

Thoughts?

Thanks!