Allow traffic on port 143

[ncolsgk]

I need to open IMAP traffic (port 143) to hit our internal Exchange box (192.168.1.9). IMAP is an IP protocol so Im unsure of the syntax but this is what I have so far:

access-list 199 permit ip any host 192.168.1.9 eq 143

 

[burtsbees]

Actually, you want tcp, not ip---is this your only access list? You are limited to how many acl's and in which direction you can apply them as far as the same inerface goes, so please post a show run, and perhaps I can help add the statement to an existing acl in your config that is already applied to an interface. Also, please tell what kind of router you have, or at least which interface and direction the acl is to be applied. Also, omit obvious public IP address and passwords (use "x"'s).

Burt

 

[ncolsgk]

No, that is not my only ACL. Router is 2821 using IOS firewall. Config is below:

interface GigabitEthernet0/1
 ip address XX.XX.XX.XX 255.255.255.252 secondary
 ip address XX.XX.XX.XX 255.255.255.224
 ip access-group 199 in
 ip nat outside
 ip inspect XXX in
 ip virtual-reassembly
 duplex full
 speed 10
 crypto map XXXXXX


access-list 100 deny   ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 deny   ip 192.168.2.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 deny   ip 10.10.10.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 deny   ip 10.10.20.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 deny   ip 10.10.11.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 100 permit ip 192.168.2.0 0.0.0.255 any
access-list 100 permit ip 10.10.11.0 0.0.0.255 any
access-list 100 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 101 permit ip 10.10.20.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 101 permit ip 10.10.11.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 150 deny   ip host 192.168.1.9 192.168.1.0 0.0.0.255
access-list 150 deny   ip host 192.168.1.9 192.168.2.0 0.0.0.255
access-list 150 deny   ip host 192.168.1.9 192.168.50.0 0.0.0.255
access-list 150 permit ip host 192.168.1.9 any
access-list 160 permit ip host 192.168.1.9 192.168.50.0 0.0.0.255
access-list 170 permit tcp host 192.168.1.6 any eq smtp
access-list 170 permit udp host 192.168.1.6 any eq domain
access-list 170 permit tcp host 192.168.1.6 any eq domain
access-list 170 permit tcp host 192.168.1.6 any eq 443
access-list 170 permit tcp host 192.168.1.6 any eq www
access-list 170 permit udp host 192.168.1.6 any eq ntp
access-list 170 deny   ip host 192.168.1.6 any
access-list 170 permit ip any any
access-list 199 permit esp any any
access-list 199 permit tcp any any eq 10000
access-list 199 permit udp any any eq isakmp
access-list 199 permit udp any any eq non500-isakmp
access-list 199 permit tcp any host XX.XX.XX.XX eq smtp
access-list 199 permit tcp any host XX.XX.XX.XX eq pop3
access-list 199 permit tcp any host XX.XX.XX.XX eq www
access-list 199 permit tcp any host XX.XX.XX.XX eq 443
access-list 199 permit tcp any host XX.XX.XX.XX eq 22
access-list 199 permit tcp any host XX.XX.XX.XX eq www
access-list 199 permit tcp any host XX.XX.XX.XX eq 443
access-list 199 permit tcp any host XX.XX.XX.XX eq www
access-list 199 permit tcp any host XX.XX.XX.XX eq ftp
access-list 199 permit tcp any host XX.XX.XX.XX eq ftp-data
access-list 199 permit icmp any XX.XX.XX.XX 0.0.0.31 echo-reply
access-list 199 permit icmp any XX.XX.XX.XX 0.0.0.31 traceroute
access-list 199 permit icmp any XX.XX.XX.XX 0.0.0.31 time-exceeded
access-list 199 permit icmp any XX.XX.XX.XX 0.0.0.31 unreachable
access-list 199 permit tcp host XX.XX.XX.XX host 67.90.82.99 eq 389
access-list 199 permit ip 192.168.50.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 199 permit ip 192.168.50.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 199 permit ip 192.168.50.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 199 permit ip 192.168.50.0 0.0.0.255 10.10.20.0 0.0.0.255
access-list 199 permit ip 192.168.50.0 0.0.0.255 10.10.11.0 0.0.0.255
access-list 199 permit udp any any eq tftp
access-list 199 permit tcp any any eq 2000
access-list 199 permit udp any any range 16384 32768

 

[ncolsgk]

So, would it be a simple:

access-list 199 permit tcp any any eq 143

 

[plshlpme]

any any would allow port 143 access to everything behind your firewall.

access-list 199 permit tcp any host 192.168.1.9 eq 143
would lock it down to your specific host.

im not sure what ios your using so it would be good to copy the access-list to notepad before doing this and then check it right after you enter it to make sure the access-list is still in tact.

 

[ncolsgk]

Thanks, I have it open, now I need to find out why these damn iPhones wont connect through IMAP.