Allow SMTP traffic through ASA

Thanks for the quick response.  

Other than the IDS add on and the service policy rules, is there something else I can configure?  

At this point, we don't use smtp over ssl.  Is there a better way to allow SMTP traffice to an internal IP?

Thanks!

That's the standard way of doing it.  You just have to remove the inspection if you start encrypting things.  If you don't, the ASA will start dropping anything it can't inspect... which includes all encrypted traffic.

This is absolutely correct if you have the ability to implement a full DMZ on the ASA.  Many of the questions that have come up with respect to the ASA deal with the ASA 5505, which cannot do a full DMZ with the base license.  If your ASA can, then question01's advice should be taken very seriously.

We are using a 5510 so I could put it in a DMZ.  

This is a remote site we use for mail bagging incase our main site is down.  How would I create a connection to the SMTP/DMZ server using standard tools like RDC or VNC?  I do not  want to create another VPN connection becuase  I would think this would be a security issue.  

Since the DMZ has a lower security lavel, I would be able to connect to it from the local site.  Would I be able to create a route from my site to send the traffic over the tunnel?  I'm sure there is more to this than just a route.  

Thanks!

This is the first mention I've heard of a tunnel.  If there's some sort of VPN in place, that will need to be factored in.

If you're going the DMZ route, you can do it in one of two ways.  You can either have public addressing in your DMZ and perform NAT between your inside network and your DMZ, or you can have private IP addressing in your DMZ and perform NAT between your DMZ and the outside network.  How we configure things depends on which route you want to go.

In either case, doing RDC or VNC from the inside to the DMZ isn't going to be an issue because of the flow between security levels.  You'll want to permit SMTP traffic between your DMZ SMTP server and your internal SMTP server so that mail flows properly.  You'll also want to permit SMTP traffic between the outside interface and the DMZ SMTP server as well.  NAT will depend on how the DMZ is configured.

We would use a private IP scheme in the DMZ.    

I follow how I will be able to access the server from the local site.  What is the best way to allow remote management of the server?  Is there a way from a remote location for me to open either tool, enter the private IP and connect to the server like I currently do with it on the inside interface?

You can perform NAT translations and assign access lists from the outside to the DMZ the same way as you would if you were going from the outside to the inside.

SMTP traffic is coming into the server and appears to be routing to my exchange server.  

When I test send an email using telnet commands, it does not work if ESMTP inspection is on.  Is this the normal behavior?  All I get is unrecognized command after I connect.

What command are you issuing?

with esmtp enabled
   220 ****************************************************************************
   *************************************
   EHLO
   500 5.3.3 Unrecognized command
   HELO
   500 5.3.3 Unrecognized command

With esmtp disabled
  220 DNS NAME Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 rea
  y at  Thu, 5 Nov 2009 11:27:24 -0500
  EHLO
  250-servername Hello [mx record ip]
  250-TURN
  250-SIZE 2097152
  250-ETRN
  250-PIPELINING
  250-DSN
  250-ENHANCEDSTATUSCODES
  250-8bitmime
  250-BINARYMIME
  250-CHUNKING
  250-VRFY
  250 OK

EHLO requires a hostname as an argument.

Try EHLO test.test.com

Tried using domain but is still reports unrecognized command.