We setup an Exchange SBS server behind a Cisco Firewall. The Exchange Server external ip is xxx.xxx.xxx.130 and the Cisco external IP is xxx.xxx.xxx.132. We setup a reverse record for our domain as the Exchange server IP address and we were getting a large number of "bounces." In the receiving messages our Exchange Server is reported as the firewall external IP address. So we changed the reverse record to point to the firewall IP and now everything appears to be going out, but occassionally some users get bounces like this:
You do not have permission to send to this recipient. For assistance, contact your system administrator.
<mail.server.local #5.7.1 smtp;550 5.7.1 <joe@mailserver.com>... Relaying denied. IP name possibly forged [xxx.xxx.xxx.132]>
How can I change this setup to get the Exchange Server reported as the correct IP address? Here is the config of my cisco. Any help would be greatly appreciated.
Current configuration : 4790 bytes
!
version 12.3
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
memory-size iomem 25
aaa new-model
!
!
no ip source-route
!
!
no ip domain lookup
!
no ip bootp server
ip cef
ip inspect name Firewall cuseeme
ip inspect name Firewall ftp
ip inspect name Firewall h323
ip inspect name Firewall icmp
ip inspect name Firewall netshow
ip inspect name Firewall rcmd
ip inspect name Firewall realaudio
ip inspect name Firewall rtsp
ip inspect name Firewall sqlnet
ip inspect name Firewall streamworks
ip inspect name Firewall tftp
ip inspect name Firewall tcp
ip inspect name Firewall udp
ip inspect name Firewall vdolive
ip inspect name Firewall http java-list 50
ip audit po max-events 100
!
!
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp key xxxxx address xxx.xxx.xxx.xxx no-xauth
crypto isakmp keepalive 10
!
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto map secure 1 ipsec-isakmp
set peer xxx.xxx.xxx.xxx
set security-association lifetime seconds 28800
set transform-set myset
match address 110
!
!
!
interface Tunnel0
description Connected to xxxx
ip address 192.168.201.2 255.255.255.252
tunnel source Ethernet0
tunnel destination xxx.xxx.xxx.xxx
!
interface Ethernet0
description Internet DSL
ip address xxx.xxx.xxx.132 255.255.255.248
ip access-group 101 in
ip nat outside
ip inspect Firewall out
no ip route-cache cef
no ip route-cache
full-duplex
no cdp enable
!
interface FastEthernet0
description connected to EthernetLAN
ip address 172.16.237.1 255.255.255.0
ip access-group 100 in
ip helper-address 192.168.1.2
ip nat inside
ip tcp adjust-mss 1300
speed auto
no cdp enable
!
ip nat pool natpool-1 xxx.xxx.xxx.130 xxx.xxx.xxx.134 netmask 255.255.255.248
ip nat inside source route-map mustnat interface Ethernet0 overload
ip nat inside source static tcp 172.16.237.14 3389 xxx.xxx.xxx.130 3389 extendable
ip nat inside source static tcp 172.16.237.14 1723 xxx.xxx.xxx.130 1723 extendable
ip nat inside source static tcp 172.16.237.14 25 xxx.xxx.xxx.130 25 extendable
ip nat inside source static tcp 172.16.237.14 443 xxx.xxx.xxx.130 443 extendable
ip nat inside source static tcp 172.16.237.14 80 xxx.xxx.xxx.130 80 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.129
ip route 192.168.1.0 255.255.255.0 192.168.201.1
ip http server
no ip http secure-server
!
!
access-list 1 permit 172.16.237.0 0.0.0.255
access-list 50 permit any
access-list 100 permit ip any any
access-list 101 permit udp any any eq bootps
access-list 101 permit udp any any eq bootpc
access-list 101 permit icmp any any echo-reply
access-list 101 permit gre any any
access-list 101 permit gre host xxx.xxx.xxx.xxx any
access-list 101 permit udp host xxx.xxx.xxx.xxx any eq isakmp
access-list 101 permit esp host xxx.xxx.xxx.xxx any
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 permit tcp any host xxx.xxx.xxx.130 eq 3389
access-list 101 permit tcp any host xxx.xxx.xxx.130 eq 443
access-list 101 permit tcp any host xxx.xxx.xxx.130 eq 1723
access-list 101 permit tcp xxx.xxx.xxx.xxx 0.0.0.31 host xxx.xxx.xxx.130 eq smtp
access-list 101 permit tcp xxx.xxx.xxx.xxx 0.0.0.31 host xxx.xxx.xxx.130 eq smtp
access-list 101 permit tcp any host xxx.xxx.xxx.130 eq www
access-list 105 permit ip 172.16.237.0 0.0.0.255 any
access-list 105 permit ip 192.168.1.0 0.0.0.255 any
access-list 110 permit ip 172.16.237.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 120 deny ip 172.16.237.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 120 permit ip 172.16.237.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
!
route-map mustnat permit 10
match ip address 120
!
snmp-server enable traps tty
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
access-class 105 in
exec-timeout 240 0
!
end
Start Free Trial
