Cisco ASA 5510 and portforwarding for SMTP

Good Morning,
I recently experienced an issue where my Cisco ASA 5510 just magically stopped forwarding SMTP traffic from outside my organization.  I have never used a ASA before.  My OWA access works and internal mail still flows.  IT is when someone outside the organization attempts to email someone here at my company, the email either does not make it and they get an errror message or it is very extremely slow in getting here.

I have attached a copy of the running config from my ASA.
Who is Participating?
You access list is wrong, this line:

access-list OUT->IN extended permit tcp any eq smtp host SHSMXC001_Inside eq smtp

should be

access-list OUT->IN extended permit tcp any eq smtp host SHSMXC001 eq smtp

As a side note because your using a PAT for you outside to inside when you send mail out it will still go out which is a good thing because you do not have a reverse record set for .37 and this would cause your mail to end up in smap folders.


The ASA config looks good, and the fact that you say some mail comes in, albeit slowly, indicates the issue is elsewhere. If the ASA was blocking mail, it would never come through.

What kind of error messages are the remote senders getting?  
dillingermAuthor Commented:
This is what I get when I try to send my self an email from my hotmail:
This is an automatically generated Delivery Status Notification.
Delivery to the following recipients failed.
  <email address>

I also am not able to telnet to my email server from outside either.  I had posted up in the exchange blogs and they advised me to come look here.  I think it would almost have to do with the firewall seeing how I  am not able to telnet into port 25 from outside.  My outisde ip for email is is where i am unable to telnet to
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Actually it looks like your external IP for mail is  and I am able to telnet into it on 25.
dillingermAuthor Commented:
That is my old mail server.  My previous colleague replaced it with a new box before his departure.  I removed that mx record and then things started going funky after that
--which is the mail server you are currently using?
Is it or
--tell us the inside and the outside ip address of the mail server you are currently using
dillingermAuthor Commented: is Inside IP of Email Server is outside IP of Email server.
So the mail server gets natted to
So anybody who wants to access the mail server from outside has to access using the public ip

so add another entry to thr access-list OUT->IN:
access-list OUT->IN extended permit tcp any host SHSMXC001 eq smtp

also add another static entry:

static(inside,outside) SHSMXC001 eq 25 SHSMXC001_Inside eq 25
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.