Specific Commands to Allow SMTP through Cisco port

Posted on 2009-12-16
Last Modified: 2013-11-30
We have an in house application that sends an email notification, by way of SMTP, to an internal recipient.  We have discovered that some computers with the application will timeout when sending the email.  We have determined that the computers with the issue are connected to particular switches that the other computers are not.

I have seen some examples of how to modify the ACL to allow/deny SMTP that make sense.  However, I am not very familiar with the Cisco NOS and do not want to bring down the network or leave an unnecessary security hole.  My goal is to allow SMTP traffic on certain ports without otherwise altering the existing configuration.  The switches involved are the Cisco 2960 and 3560.

Could some one tell me the specific commands I would use to allow SMTP on a specific port without otherwise changing the existing configuration?  Any help would be greatly appreciated and would say us a service call.  

Thank you very much in advance,
Question by:jmarkh68
    LVL 6

    Expert Comment

    Copy the ACL and add permit tcp any eq 25 in the appropriate entry

    Just make sure the entry to allow smtp is before an entry which would deny it.

    access-list 101 deny ip any any
    access-list 101 permit tcp any any eq 25

    The second line wouldn't be applied since the first denys all ip traffic


    Author Comment

    Does 101 represent the VLAN?
    Does 'permit tcp any any eq 25' mean to allow any traffic in and out on port 25?
    How do I copy the ACL?

    All I really know how to do is change the VLAN on a port.  Some one showed me that step by step.
    LVL 6

    Accepted Solution

    Are there ACL's on the switch?  Look for ip access-group <number/word> in/out, applied to either a port or vlan.  the number/word here is the name of the ACL.  Copy and paste the acl to notepad and add an entry that corresponds to the format.

    if it's ip access-group 101 then, add "access-list 101 permit tcp any any eq 25"....yes this allows all traffic to use smtp

    when the acl is applied to a port or vlan its either: ip access-group 101 in or ip access-group 101 out
    With an 'any any' in/out doesn't make a difference, when using specific ranges it does.

    2 examples doing the same thing:
    EX 1:
    access-list 101 permit ip
    ip access-group 101 in

    EX 2:
    access-list 102 permit ip
    ip access-group 102 out

    If you post your switch config, I can be more specific

    Author Comment

    I think I need to learn more about Cisco commands.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    There was an incident about the POP3 issue for the double read receipts and delivery receipts in Exchange 2013.  There was huge research been done and found solution for the duplicate mails. Especially when the user gets  duplicate mails.
    Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now