Can't reach Mail ---Only from static assignments

[MJNSBF]

Hello. I have a weird situation. I have a pix 501 and have a few static assignments for some pc's behind the firewall. These people can access anything outside the firewall EXCEPT our mail server. Now, anyone behind the firewall getting a dhcp assignment from a server can access the mail server fine. Any ideas as to what would be causing this? I have a PIX 515 configured and running great for about 2 months now...the static assignments don't have this issue. Any insight is appreciated.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password aLWqpVQyMGCjOo33 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname tepix
domain-name example.com
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
access-list 101 permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 101 permit ip any 192.168.1.0 255.255.255.192
access-list outside_access_in permit tcp any host x.x.x.88 eq ftp
pager lines 24
logging on
logging buffered warnings
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.249 255.255.255.0
ip address inside 192.168.20.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 192.168.1.1-192.168.1.50
pdm location x.x.x.222 255.255.255.255 outside
pdm location 192.168.20.60 255.255.255.255 inside
pdm logging warnings 512
pdm history enable
arp timeout 60
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 192.168.20.0 255.255.255.0 0 0
static (inside,outside) x.x.x TENA netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.104 NAMO netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.60 192.168.20.60 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.88 EUROPA dns netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.1 1
route inside EUROPA 255.255.255.255 192.168.20.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http x.x.x.0 255.255.255.0 outside
http 192.168.20.0 255.255.255.0 inside
http EUROPA 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside EUROPA /c:/tftp/
floodguard enable
sysopt connection permit-pptp
sysopt noproxyarp inside
sysopt route dnat
telnet timeout 5
ssh timeout 5
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 client configuration dns x.x.x.31
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username uname password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.20.100-192.168.20.131 inside
dhcpd lease 259200
dhcpd ping_timeout 750
dhcpd domain example.com
terminal width 80

 

[baddos]

Add this and replace the XXX's w/ the email server's IP address.
access-list outside_access_in permit tcp any host x.x.x.XXX eq smtp

Also make sure that there is a static setup for that email server.

 

[MJNSBF]

Sorry, I didn't make myself clear. The mail server is located behind another firewall and is functioning properly behind it. The issue is with my users behind my pix 501. The dhcp users can access my external mail server fine. The static assignment users can not (but they can access internet and anything else just fine).

Thanks,

M

 

[baddos]

Your current configuration isn't blocking any outgoing access. I would verify that you are getting the correct IP address for the mail server and that DNS is working.

 

[yizhar]

HI.

> ip address outside x.x.x.249 255.255.255.0
Do you actually have a registered class C subnet, or is x.x.x.x a private network and do you have another NAT/PAT device in the path to the Internet?


> ip address inside 192.168.20.1 255.255.255.0
> route inside EUROPA 255.255.255.255 192.168.20.1 1
You should remove the route command above unless there is a reason for it.

> logging buffered warnings
Check the log for messages related to the failing connections attempt. Do you get any?

What kind of mail server is it (sendmail on unix, exchange on w2k, etc..)?
Which protocols are in use (POP3,SMTP,etc)?
Check if the following has anything to do with the problem:

http://www.cisco.com/warp/public/110/2.html

http://www.cisco.com/warp/public/110/21.html

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[MJNSBF]

Hi Yizhar.

Yes, that address is a registered class c subnet. I removed the line you suggested (meant to do that earlier), and I have checked the log for failing connects. I see nothing. We are using a Merak Mail Server which runs on windows 2000. I checked out the links you suggested, but their resolutions did not work.

I did find out another interesting point in the process.......the only static's that aren't getting to this server, are the ones that have registered names in the external name server. For example, example.company.com won't get there......, but a static that does not have a name associated with it will get their ok.

Thanks,

M

 

[baddos]

If this is a registered class c, then do one static for the whole netblock and remove all the single statics.

 

[yizhar]

HI.

Check the mail server configuration and logs.
Try to use TELNET to send email from one of the clients - how far can you get?
Can you establish a TCP connection to port 25 of the server?
Do you get any error from the server during the SMTP dialog?

This articel is for MS Exchange but should work with any SMTP server:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q153119&ID=KB;EN-US;Q153119&FR=1&PA=1&

Same idea goes for POP3 connections, use these POP3 comands:
USER
PASS
LIST
QUIT

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar