ASA 5510 DMZ

Posted on 2008-11-16
Last Modified: 2012-05-05
I have an ASA 5510 with a DMZ question.  DMZ is set up and works for outbound any to any less secure and also inbound https to a dmz host.  I need to allow a host in the DMZ to access our internal mail server (smtp) on the inside.  When I add the access list to allow the host in the DMZ to contact inside mail server it removes the any to any less secure and stops outbound access to the internet from the DMZ.  
My question is how to allow this again?  I tried an ACL on DMZ incoming for DMZ hosts to outside but that did not work.  I know if I add ACL to allow DMZ hosts to any it allows this but also appears to allow access to the inside for any traffic.  Do I need to create access lists for the inside interface in outgoing direction to allow smtp from dmz host and then block everything else?   This seems like it would work but seems like a round about way of doing this so I thought I should ask.

Question by:PaulSand
    LVL 79

    Accepted Solution

    The acl would look something like this:

    access-list dmz_acl permit tcp host <dmz host ip> host <inside mail server ip> eq 25
    access-list dmz_acl deny ip host <dmz host ip> <inside LAN subnet> <mask>
    access-list dmz_acl permit ip any any
    global (dmz) 1 interface


    Author Closing Comment

    Thank you Irmoore.  I had a feeling I was missing something obvious.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
    This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now