How to open up SMTP port on Cisco 800 series router?

Posted on 2004-03-31
Medium Priority
Last Modified: 2007-12-19
I have a Cisco 800 series router which at the moment for some reason is showing the SMTP port closed/shut and our ISP is unable to relay mail to the company network.  I should be able to telnet to the router from outside to the public IP address i.e. telnet x.x.x.x 25 but I cannot now for some reason.

My question is how do I open up that port on the router to accepting incoming connections for mail, presummably I need to do that on the dialer interface.  I have a NAT rule to forward to the exchange once it comes in  just need to open that port up.

Any suggestions?

Thanks in advance.

Question by:tnrphantom
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Expert Comment

ID: 10726874
Try adding this to the access-list on your external interface:

Access-list <list#> permit tcp any host X.X.X.X eq smtp

where X.X.X.X is the IP address of your mail server, and <list#> is the access list number you are configuring.  You must be in global configuration mode to add to the list.  Access lists are what prevent and allow packets hitting your router.  If you have a deny entry in the access list that is denying the smtp packets...the above line will need to be entered into the access list before the deny line.  This is because once a packet matches a specific line in the access list, all other lines in the list are ignored.

It is useful to use the "?" command when trying to understand the different options in these access list commands.  For example if you are typing the above command but type a "?" after "permit" you will be provided with a list of available commands to follow the "permit"

Author Comment

ID: 10726943
What does the eq stand for in teh command like also i presume instead of actually writing smtp i type '25' instead, also does it matter what number access list i put it in?



Expert Comment

ID: 10727033
The eq is saying to match a specific port number, which you give with the next command "smtp", which yes means port 25.  And you dont need to type 25, you can just type "smtp".

if you don't want to specify which server on your network you want to allow the traffic to (you want to allow smtp traffic bound for all internal computers) use this command:

Access-list <list#> permit tcp any any eq smtp

Yes, it does matter which Access-list number you put it in.  You need to know which access list # is currently applied to your external interface.  This is the access list number you need to add the permit command to.  You can see which Access list is applied to your interface with the "show run" command.
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.


Expert Comment

ID: 10727046
To clarify the eq part; if you didn't have this portion in the command such as:

Access-list <list#> permit tcp any host X.X.X.X

then you would be opening all ports to packets incoming to the specified IP address.

Author Comment

ID: 10727101
Thanks for that.

Please bear with me on this, if I could just clarify.......

I have gone into config t and entered the access list as you originally stated as access-list 110 permit tcp any host 192.168.x.x eq smtp (this address is the Surf Control Email filter, that then forwards mails to the exchange)

Now when I do a sh run I see the access list listed but above it a see other access lists and at the very top one which is access-list 101 says access-list 101 permit ip any any, which in theory must mean everything is open at the moment so why is mail still not flowing

Am I missing something? also how do i remove the access-list?



Accepted Solution

Brian1 earned 500 total points
ID: 10727895
Well first of all the address 192.168.x.x is a private (internal) email address.  Email coming from the internet is going to be going to the public (external) address of your "Surf Control Email filter".  You obviously have NAT translating the public address to the private 192.168.x.x.

When you do the show run, it will show you all the access lists configured in the router.  These access lists are only utilized if they are applied to an interface.  On the show run, look for the Dialer interface, and if there is an access list applied to it you will see something like "ip access-group 101 in".  This would mean that access-list 101 is applied to the Dialer interface.

I don't know alot of the specific commands to execute all this stuff off the top of my head, so I suggesst you pick up a book on Cisco IOS, or check out the Cisco website.

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Cable Modem Provisioning from DPoE compliant server  This Article is to support CMTS administrators to provide an overview of DOCSIS compliance configuration file, and to provision a cable modem located at customer place from a Back office serve…
Sometimes you have to pull out old tricks to get a new firewall to work… While we were installing a new Sonicwall at a customers site we found that sites they were able to visit before were not working.  It seemed random and we could not understa…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses
Course of the Month13 days, 11 hours left to enroll

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question