Hi,
Have checked the treats in here. Cannot get my ASA 5505 to publish my smtp server. This is my config. Any idears ?
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
names
!
interface Vlan1
nameif inside
security-level 100
ip address 172.16.150.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.3 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list outside extended permit tcp any interface outside eq smtp
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp 172.16.150.2 smtp netmask 255.255.255
.255
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 172.16.150.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 172.16.150.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The Config looks good to me. From the outside, you should be able to telnet to port 25 on the outside IP and get the SMTP prompts. Do you get this?
There must be at least 1 other device between this firewall and the public internet since you have a non-routable ip on the outside... what device is it and is it set to pass port 25 as well?
I would concur.
I might guess its a modem/router given the common IP. If it is the only thing in between the ASA and internet (curious why it's .3), I would typically set it to do transparent/RFC bridging. There is no sense in not having your ASA on the internet. It is more convinent when setting up port forwarding, or RA/site 2 site VPNs.
You would need to check with your ISP, on how you obtain your IP, most likely some sort of DHCP if it is a modem/router. After you've bridged the modem, your interface IP will be:
ip address DHCP setroute.
pppoe DSL would work something like this
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group DSLGroupName
ip address pppoe setroute
vpdn group DSLGroupName request dialout pppoe
vpdn group DSLGroupName localname DSLuser@dsl-isp.net
vpdn group DSLGroupName ppp authentication pap
vpdn username DSLuser@dsl-isp.net password (yr pwd) store-local
Sharedit is right, definitely be sure you're in bridging mode on the ISP provided DSL modem; you don't wnat that thing Natting or with a dhcp server enabled on the LAN side. It's worth mentioning, because the IP of your WAN interface, unless you just put that in there for the sake of not wanting to reveal your actual IP, is a 1918 address, so you're behind an ISP device that is natting. You don't want that if you're going to use an ASA. Even if the ISP will open a pinhole for you, on most of those ISP dsl modems (like 2Wire), when a pinhole (they call them pinholes) is opened, the device will kill arp after 10 min once a connection is made - this will kill PIX / ASA. Have them put that thing in bridge mode so you can just put static IPs on your equipment.
Also, using "tcp interface" in the access-list is a notorious failure point in ASA code. In your access-list, replace "tcp interface" with the actual IP address of the interface. --TX
Business Accounts
Answer for Membership
by: JFrederick29Posted on 2009-11-02 at 09:50:08ID: 25721665
Config looks fine. Do you have another device on the "outside" of the ASA? If so, did you setup port forwarding for the SMTP traffic to 192.168.1.3 on that device?