Hi Cat6509,
Thanks for your reply.
The problem is not with the PIX, but with the ASA.
Everything is ok through the PIX.
Main Topics
Browse All Topics
Loading Advertisement...
Question
Cisco ASA 5520 blocks SMTP when using TLS
Hi,
We have a Cisco ASA 5520 in our setup and in the dmz we have a postfix server, where we have applied a certificate and configured postfix to use that certificate.
When connecting from outlook 2007 using TLS from the inside and to the postfix server in the dmz it works, but when connecting from the outside to the postfix server it does not work.
When going from outside to the postfix traffic is passing through the asa 5520, but when going from the inside to the postfix server traffic is passing through a PIX501.
The ASA is running:
Cisco Adaptive Security Appliance Software Version 7.0(7)
Device Manager Version 5.0(7)
This is our inspection policy:
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect rsh
inspect sqlnet
inspect xdmcp
inspect netbios
inspect tftp
policy-map policy_global
policy-map type
!
service-policy global_policy global
smtp-server <ip1> <ip2>
Cryptochecksum:xxxxxxxxxxx
We have also allowed traffic on port 25 and that works for non TLS traffic.
We really need TLS to be allowed through the ASA.
Can somebody help with an answer?
Thanks.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
The normal SMTP part has worked, and I have just configured TLS og the postfix server and want to grant access to TLS from the outside.
I have tried both with and without inspection of esmtp. Both does not work.
This is my config:
: Saved
:
ASA Version 8.0(4)
!
hostname ciscoasa
domain-name xyz.xx
enable password xxxxxxx encrypted
passwd xxxxxxxx encrypted
names
name <IP1> pollux description Postfix mail server
name <IP2> castor description webserver
name <IP3> pix description PIX for internal network
name <IP4> C3560G description C3560G
name <IP5> xxx description xxx
name <IP6> ExchangeServer
name <IP7> BBInside
name <IP8> aldebaran
name <IP9> arcturus
name <IP10> xxxxyyy description xxxyyy
name <IP11> rb
name <IP12> vega
name <IP13> webmail
name <IP14> KB15 description KB15
name <IP15> orion
name <IP16> Hoelstad
name <IP17> Jonas
name <IP18> Jonaskontor
name <IP19> JonasHjemme
name <IP20> JonasExchange
dns-guard
!
interface GigabitEthernet0/0
speed 100
duplex full
nameif internet
security-level 0
ip address xxx xxx
!
interface GigabitEthernet0/1
nameif inside
security-level 50
ip address xxx xxx
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup internet
dns server-group DefaultDNS
name-server yyy
name-server yyy2
domain-name xxxx.xxx
object-group network FTPUsers
description Group for FTP Users
network-object KB15 255.255.255.255
network-object xxxx 255.255.255.255
network-object Hoelstad 255.255.255.255
object-group service webservices tcp
port-object eq www
port-object eq https
object-group service FTPServer tcp
port-object eq ftp-data
port-object eq ftp
object-group service VPNports4500 udp
port-object range 4500 4500
port-object range isakmp isakmp
object-group service BB tcp
port-object range 1984 1984
object-group network BBUsers
network-object KB15 255.255.255.255
network-object xxxxx 255.255.255.255
object-group network DMZSSHHosts
description Group for SSH Hosts
network-object aldebaran 255.255.255.255
network-object arcturus 255.255.255.255
network-object vega 255.255.255.255
network-object orion 255.255.255.255
object-group network DMZSSHHosts_ref
network-object aldebaran 255.255.255.255
network-object arcturus 255.255.255.255
network-object vega 255.255.255.255
network-object orion 255.255.255.255
object-group service mailservices tcp
port-object eq pop3
port-object eq smtp
object-group network POP3users
network-object KB15 255.255.255.255
network-object Jonas 255.255.255.255
network-object Jonaskontor 255.255.255.255
network-object JonasExchange 255.255.255.255
network-object JonasHjemme 255.255.255.255
object-group service SMTPSSL tcp-udp
port-object eq 465
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp eq 465
service-object tcp eq https
access-list internet_access_in extended permit tcp any host webmail object-group webservices
access-list internet_access_in remark Rule for web traffic
access-list internet_access_in extended permit tcp any host castor object-group webservices
access-list internet_access_in remark Rule for web traffic
access-list internet_access_in extended permit tcp any host aldebaran object-group webservices
access-list internet_access_in remark Rule for Mailserver
access-list internet_access_in extended permit tcp any host pollux eq smtp
access-list internet_access_in extended permit object-group DM_INLINE_SERVICE_1 any host pollux
access-list internet_access_in remark Rule for SSH on port 1863
access-list internet_access_in extended permit tcp any host pollux eq 1863
access-list internet_access_in remark Rule for Remote Backup
access-list internet_access_in extended permit tcp any host xxxxx eq https
access-list internet_access_in remark FTP Rule
access-list internet_access_in extended permit tcp object-group FTPUsers host castor object-group FTPServer
access-list internet_access_in remark FTP Rule
access-list internet_access_in extended permit tcp object-group FTPUsers host aldebaran object-group FTPServer
access-list internet_access_in extended permit ip host KB15 host pix inactive
access-list internet_access_in extended permit tcp host KB15 host castor eq ssh
access-list internet_access_in extended permit tcp object-group POP3users host pollux object-group mailservices
access-list internet_access_in extended permit tcp host KB15 object-group DMZSSHHosts_ref eq ssh
access-list internet_access_in extended permit tcp host KB15 host arcturus eq ssh inactive
access-list internet_access_in extended permit tcp host KB15 host arcturus eq 5900 inactive
access-list internet_access_in remark BB Rule
access-list internet_access_in extended permit tcp object-group BBUsers host castor eq 1984
access-list internet_access_in extended permit udp any host pix object-group VPNports4500
access-list internet_access_in extended permit tcp host KB15 host pix eq https inactive
access-list internet_access_in remark VPN ESP protocol
access-list internet_access_in extended permit esp any host pix
access-list internet_access_in extended permit tcp host KB15 host ExchangeServer eq smtp
access-list internet_access_in extended permit tcp any host ExchangeServer eq https inactive
access-list internet_access_in extended permit tcp host KB15 host BBInside object-group webservices
access-list internet_access_in extended permit gre host KB15 host webmail inactive
access-list internet_access_in extended permit tcp host KB15 host webmail eq pptp inactive
access-list internet_access_in extended permit udp host KB15 host webmail object-group VPNports4500
access-list internet_access_in remark Denial
access-list internet_access_in extended deny ip any any
access-list inside_nat0_outbound remark PIX Exemption Rule
access-list inside_nat0_outbound extended permit ip host pix host KB15
pager lines 24
logging enable
logging asdm informational
logging from-address mailaddesss@mail.xxx
logging recipient-address mailaddr@mail.xxx level errorsa
mtu internet 1500
mtu inside 1500
mtu management 1500
ip verify reverse-path interface internet
ip verify reverse-path interface inside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 0 0.0.0.0 0.0.0.0
static (inside,internet) castor castor netmask 255.255.255.255
static (inside,internet) aldebaran aldebaran netmask 255.255.255.255
static (inside,internet) arcturus arcturus netmask 255.255.255.255
static (inside,internet) pollux pollux netmask 255.255.255.255
static (inside,internet) xxxx xxxx netmask 255.255.255.255
static (inside,internet) orion orion netmask 255.255.255.255
static (inside,internet) pix pix netmask 255.255.255.255
static (inside,internet) C3560G C3560G netmask 255.255.255.255
static (inside,internet) ExchangeServer ExchangeServer netmask 255.255.255.255
static (inside,internet) BBInside BBInside netmask 255.255.255.255
static (inside,internet) vega vega netmask 255.255.255.255
static (inside,internet) webmail webmail netmask 255.255.255.255
access-group internet_access_in in interface internet
route internet 0.0.0.0 0.0.0.0 <gwIP>
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-reco
aaa authentication ssh console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http xxxxxx 255.255.255.255 inside
http pix 255.255.255.255 inside
http KB15 255.255.255.255 internet
snmp-server host inside castor community xzxzxzx
snmp-server location klkl
snmp-server contact XYZ
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet pix 255.255.255.255 inside
telnet timeout 5
ssh KB15 255.255.255.255 internet
ssh timeout 5
ssh version 2
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username 123 password uiouiuiiu encrypted
username 456 password lkjkjkj encrypted privilege 15
!
class-map test
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map type inspect esmtp tls
parameters
no mask-banner
allow-tls action log
match sender-address length gt 320
log
match MIME filename length gt 255
log
match cmd line length gt 512
log
match cmd RCPT count gt 100
log
match body line length gt 998
log
policy-map global_policy
class inspection_default
inspect ftp
inspect rsh
inspect sqlnet
inspect xdmcp
inspect netbios
inspect tftp
inspect dns migrated_dns_map_1
inspect esmtp tls
policy-map policy_global
!
service-policy global_policy global
smtp-server pollux castor
prompt hostname context
Cryptochecksum:4545544545
: end
asdm image disk0:/asdm-613.bin
asdm location castor 255.255.255.255 inside
asdm location pollux 255.255.255.255 inside
asdm location orion 255.255.255.255 inside
asdm location pix 255.255.255.255 inside
asdm location C3560G 255.255.255.255 inside
asdm location xxxxxxx 255.255.255.255 internet
asdm location zxxxxxx 255.255.255.255 internet
asdm location webmail 255.255.255.255 inside
asdm location KB15 255.255.255.255 internet
asdm group FTPUsers internet
asdm group BBUsers internet
asdm group DMZSSHHosts inside
asdm group DMZSSHHosts_ref internet reference DMZSSHHosts
asdm group POP3users internet
no asdm history enable
Thanks for the clarification!
Are you using Real Public IP addresses on the inside?
The reason I ask is I see your nat statments
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 0 0.0.0.0 0.0.0.0
But no Global statement to go with.
I then see:
static (inside,internet) pollux pollux netmask 255.255.255.255 --> which appears to mean you are doing a static from the same IP outside as inside.
The above I ask as clarification to the setup. But what I think you want to do is this:
http://www.cisco.com/en/US
"Note: If you use Transport Layer Security (TLS) encryption for e-mail communication then the ESMTP inspection feature (enabled by default) in the PIX drops the packets. In order to allow the e-mails with TLS enabled, disable the ESMTP inspection feature as this output shows."
Basically is says to remove esmtp
Regards,
3nerds
Your using this:
class-map inspection_default
match default-inspection-traffic
which means your using these:
default-inspection-traffic
ctiqbe----tcp--2748 dns-------udp--53
ftp-------tcp--21 gtp-------udp--2123,3386
h323-h225-tcp--1720 h323-ras--udp--1718-1719
http------tcp--80 icmp------icmp
ils-------tcp--389 mgcp------udp--2427,2727
netbios---udp--137-138 radius-acct---udp--1646
rpc-------udp--111 rsh-------tcp--514
rtsp------tcp--554 sip-------tcp--5060
sip-------udp--5060 skinny----tcp--2000
smtp------tcp--25 sqlnet----tcp--1521
tftp------udp--69 waas------tcp--1-65535
xdmcp-----udp--177
You would have to stop using the default temporarlly and test it.
class-map inspection_default
no match default-inspection-traffic
and then if it works build your own.
Regards,
3nerds
I have to honest you config has me scratching my head a bit.
You have nat statements but no global and your statically translating the same address outside to the inside. That just seems odd to me, can't say I have seen anything like that other than in a transparent config and even that was alot different.
I am wondering if you are running into a bug with you translations, but try the smtp part and let me know.
Regards,
3nerds
BTW in the postfix log, this is what I get when connecting from the Internet:
Jun 12 22:12:51 pollux postfix/smtpd[93330]: initializing the server-side TLS engine
Jun 12 22:12:51 pollux postfix/smtpd[93330]: connect from xxxxxxx
Jun 12 22:12:51 pollux postfix/smtpd[93330]: lost connection after EHLO from xxxxxxx
Jun 12 22:12:51 pollux postfix/smtpd[93330]: disconnect from xxxxxxx
When doing the same thing from inside I get this in the postfix log:
Jun 12 22:15:13 pollux postfix/smtpd[93330]: connect from yyyyyyy
Jun 12 22:15:13 pollux postfix/smtpd[93330]: setting up TLS connection from yyyyyyy
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:before/accept initialization
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:error in SSLv2/v3 read client hello A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:error in SSLv2/v3 read client hello B
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 read client hello A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 write server hello A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 write certificate A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 write server done A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 flush data
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:error in SSLv3 read client certificate A
Jun 12 22:15:13 pollux last message repeated 2 times
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 read client key exchange A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:error in SSLv3 read certificate verify A
Jun 12 22:15:13 pollux last message repeated 3 times
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 read finished A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 write change cipher spec A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 write finished A
Jun 12 22:15:13 pollux postfix/smtpd[93330]: SSL_accept:SSLv3 flush data
Jun 12 22:15:13 pollux postfix/smtpd[93330]: TLS connection established from yyyyyyy: TLSv1 with cipher RC4-MD5 (128/128 bits)
Jun 12 22:15:13 pollux postfix/smtpd[93330]: 50E3213C421: client=yyyyyyy, sasl_method=LOGIN, sasl_username=zzzzzzzz
Jun 12 22:15:13 pollux postfix/cleanup[93337]: 50E3213C421: message-id=<20090612201513.
Jun 12 22:15:13 pollux postfix/qmgr[93319]: 50E3213C421: from=<zzzzzzzzz>, size=785, nrcpt=1 (queue active)
Jun 12 22:15:13 pollux postfix/smtpd[93330]: disconnect from yyyyyyyy
Jun 12 22:15:13 pollux postfix/virtual[93343]: 50E3213C421: to=<zzzzzzzz>, relay=virtual, delay=0, status=sent (delivered to maildir)
Jun 12 22:15:13 pollux postfix/qmgr[93319]: 50E3213C421: removed
THis is what I get in outlook
Task 'yyyyyy - Sending' reported error (0x800CCC7D) : 'Your server does not support the connection encryption type you have specified. Try changing the encryption method. Contact your mail server administrator or Internet service provider (ISP) for additional assistance.'
I am just wondering if it could be my locally cisco router that somehow blocks for TLS to the ASA in the datacenter?
The ASA is located within a datacenter and I am sitting at a remote office to the datacenter.
I will just login to the cisco 1811 router and take a look.
Thanks for clarifying the no nat-control thing I didn't see it in your config and well when you do that command it actually removes it from the config =)
Just out of curiosity why not just run all of this off the asa and simplify it? It wouldn't be bad to do and would most likely solve your problem.
Just curious.
Regards,
3nerds
I am doing some testing on a pix I have with 8.04 loaded and when i attempt what you are doing I get errors.
Specifically: ERROR: Failed to apply IP address to interface Ethernet1, as the network overlaps with interface Ethernet0. Two interfaces cannot be in the same subnet
So are your inside and outside on different subnets? This would seem odd seeing that your nat'ing the same address inside as outside.
3nerds
Hi 3nerds,
You won't believe it. But the error was not in the ASA it was in my Cisco 1811 which is in my office an through which I connect to the internet from the office.
The C1811 also had an inspection policy enabled for esmtp, and it was that policy that stripped out the TLS from the smtp traffic.
when I disablet the esmtp in my C1811 it worked.
Thank you VERY MUCH. :-) :-)
It is very good to have somebody like you to try out different things.
I will give you all the points for your assistance.
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: cat6509Posted on 2009-06-12 at 04:38:51ID: 24611115
you have already removed the insect esmtp form teh asa, but how about the pix?
If it is running older PIX code the command is
no fixup protocol smtp