?
Solved

Restricting smtp traffic to specific IP address ranges PIX 506e

Posted on 2011-03-22
5
Medium Priority
?
780 Views
Last Modified: 2012-05-11
We used to have our spam filter on the inside network; now we have outsourced to an outside spam filtering company.  Our current setting is to allow all smtp (port 25) traffic through our firewall to our Exchange 2003 server.  

I want to restrict all smtp traffic through the PIX 506 except from the following WAN IP address ranges:

194.116.198.0/23 (194.116.198.0 to 194.116.199.255) subnet 255.255.254.0
208.87.136.0/23 (208.87.136.0 to 208.87.137.255) subnet 255.255.254.0
203.100.58.0/24 (203.100.58.0 to 203.100.58.255) subnet 255.255.255.0

current Pix access list entry is:

access-list acl-out permit tcp any interface outside eq smtp

I'm just a bit rusty on adding the ranges.
0
Comment
Question by:techcontracting
5 Comments
 
LVL 4

Expert Comment

by:m_walker
ID: 35195809
I cant remember which why it is on the pix.
My 3750 does it this way
access-list 110 permit tcp 172.30.0.0 0.0.255.255 any eq 22 log

so I would try

access-list acl-out permit tcp <network> <pattern> interface outside eq smtp
eg: for 194.116.198.0/23
/23 = 23 bits = pattern (not mask) 0.0.1.255
access-list acl-out permit tcp 194.116.198.0 0.0.1.255 interface outside eq smtp

203.100.58.0/24
access-list acl-out permit tcp 203.100.58.0 0.0.0.255 interface outside eq smtp

just check with the ? when you get to the "mask/pattern" and see if it wants a match pattern or subnet mask.
0
 
LVL 6

Accepted Solution

by:
Draxonic earned 2000 total points
ID: 35196104
http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/ab.html#wp1067755

access-list acl-out permit tcp 194.116.198.0 255.255.254.0 interface outside eq smtp
access-list acl-out permit tcp 208.87.136.0 255.255.254.0 interface outside eq smtp
access-list acl-out permit tcp 203.100.58.0 255.255.255.0 interface outside eq smtp

0
 
LVL 79

Expert Comment

by:lrmoore
ID: 35197703
PIX always uses subnet masks for access-lists, where routers and IOS based switches always use wildcard masks.
Don't forget to remove the acl entry permitting any interface outside eq smtp
 no acl-out permit any interface outside eq smtp
0
 
LVL 4

Author Comment

by:techcontracting
ID: 35204089
Hey guys thanks for all your help... I had the config in there except I had "tcp host" instead of just "tcp";  thanks for the clarification... works like a dream.

Thanks again,
Shawn
0
 
LVL 4

Author Closing Comment

by:techcontracting
ID: 35204095
Worked great... thanks!
0

Featured Post

Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month9 days, 19 hours left to enroll

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question