I have a PIX 501 that is currently configured via NAT on the outside interface to deliver mail via smtp to a single smtp server on the LAN.
I need to restrict access so that permitted IP ranges only are allowed to deliver mail. There will be more than one range of addresses.
I have added the following
name 12.129.20.0 PermittedRange1
name 12.129.199.61 PermittedRange2
access-list fromoutside permit tcp PermittedRange1 255.255.255.0 host <outside IP> eq smtp
access-list fromoutside permit tcp PermittedRange2 255.255.255.255 host <outside IP> eq smtp
etc etc
Is it sufficient to add this for each range of IP addresses that I require to allow. Do I need to add an explicit deny for everything else or is that implied?
Do I need to add anything else to the config?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
There is an implicit deny at the end of every access-list. You could create an object-group to just hold all of the subnets that you allow so it's easier to manage by adding/removing to the object group:
object-group network Email_Range
network-object 1.0.0.0 255.0.0.0
network-object 2.0.0.0 255.0.0.0
access-list email permit tcp object-group Email_Range host <ip address> eq smtp
Business Accounts
Answer for Membership
by: jodylemoinePosted on 2009-10-29 at 10:09:22ID: 25695836
An implicit deny is assumed at the end of every access list. As long as you don't have any subsequent statements that allow the traffic to come in by being too permissive, you'll be fine.