Solved

ASA PAT works for incoming SMTP but not outgoing

Posted on 2009-07-02
4
1,118 Views
Last Modified: 2013-11-30
We had an exchange server on our internal 10.x.x.8 and external x.x.x.194 recently we installed a Cisco Ironport Anti-Spam appliance at internal 10.x.x.29 which needs SMTP traffice directed towards it but other protocols still going to 10.x.x.8 so I created a few PAT rules on the ASA to do this. I've confirmed everything coming from the outside in is directed to the correct machine but when the Ironport sends email it's sending it via the wrong external address x.x.x.195

I don't know if I need to specify Ironport to send mail ONLY on port 25 (thus forcing to follow the PAT) if so I don't know how to do that in the Ironport.

Or if there's some way in the ASA to force the Ironport appliance mail through the 194 external IP.


Here are the related config entries from the ASA.
global (outside) 1 interface

global (outside) 2 x.x.x.194 netmask 255.0.0.0

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0
 
 

access-list 100 extended permit ip any any inactive

access-list 100 extended permit tcp any host x.x.x.194 eq www

access-list 100 extended permit tcp any host x.x.x.194 eq 3389

access-list 100 extended permit tcp any host x.x.x.194 eq smtp
 

static (inside,outside) tcp 63.225.3.194 www 10.x.x.8 www netmask 255.255.255.255

static (inside,outside) tcp 63.225.3.194 3389 10.x.x.8 3389 netmask 255.255.255.255

static (inside,outside) tcp 63.225.3.194 smtp 10.x.x.29 smtp netmask 255.255.255.255

Open in new window

0
Comment
Question by:rguadiana
  • 2
  • 2
4 Comments
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
If you can set the Ironport to send mail using a source port of anything other than port 25, that'll be all you need.
Else, you can just change your dns MX record to be the 194 external IP
0
 

Author Comment

by:rguadiana
Comment Utility
I think the Ironport IS using a source port other than 25 which is causing it to use the dynamic PAT on the ASA and using the 195 ip. Our dns MX record is already set to 194, that's why I need the Ironport to send mail through port 25 and IP 194.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 125 total points
Comment Utility
Aha... OK..

Access-list IRONPORT permit tcp host 10.x.x.29 any eq smtp
nat (inside) 2 access-list IRONPORT
0
 

Author Closing Comment

by:rguadiana
Comment Utility
Thanks very much! worked like a charm
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now