Pix 506E mail server problem

[jose458]

I have mail server on interface inside with address 192.168.0.210, and i configute static nat 200.110.56.8, server send and receive all mails, i need configure smtp and pop3 server with address 200.110.56.8 but no response ping, only response witk internal addres 192.168.0.210, i need configure some adicional?

 

[308win]

permit just the two ports with your outside acl

access-list outside-acl permit tcp any host outsideaddress eq smtp
access-list outside-acl permit tcp any host outsideaddress eq pop3

replace your current static for the mail server with:

static (inside,outside) tcp outsideaddress smtp insideaddress smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp outsideaddress pop3 insideaddress pop3 255.255.255.255 0 0

access-group outside-acl in interface outside


obviously adjust the outside acl if need be for other protocols allowed at other hosts.

Brian

 

[jose458]

changes no solved my problem, i add this commnad in my configuration and user external no see my server
y send my configuiration

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password Qg/7JnMXbbNP6lPi encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname test-maristas
domain-name maristas.com.co
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.0.3 SIIGO
name 192.168.0.109 Ingrid
name 192.168.0.210 Correo
name 200.71.78.32 Technopia
name 200.71.78.126 jose458
access-list outside-acl permit tcp any host 200.110.105.195 eq smtp
access-list outside-acl permit icmp any any
access-list outside-acl permit tcp any host 200.110.105.195 eq pop3
access-list outside-acl permit tcp any host 200.110.105.195 eq www
access-list outside-acl permit tcp any host 200.110.105.195 eq 32000
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside 200.110.105.194 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.108 255.255.255.255 inside
pdm location SIIGO 255.255.255.255 inside
pdm location Ingrid 255.255.255.255 inside
pdm location Correo 255.255.255.255 inside
pdm location Technopia 255.255.255.224 outside
pdm location jose458 255.255.255.255 outside
pdm location 200.71.78.128 255.255.255.224 outside
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 200.110.105.196 SIIGO netmask 255.255.255.255 0 0
static (inside,outside) 200.110.105.195 Correo netmask 255.255.255.255 0 0
access-group outside-acl in interface outside
route outside 0.0.0.0 0.0.0.0 200.110.105.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.0.108 255.255.255.255 inside
http SIIGO 255.255.255.255 inside
http Correo 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 200.71.78.128 255.255.255.224 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:37362253e27d8f429e29f3cb22c4ac2c
: end



this copnfiguration permit user external see my mail server, but internal user (192.168.0.X) no see http.//200.110.105.195:32000/mail

 

[br0ck]

Just a pice of advice........


edit your config before posting

i could take the password hashes

enable password Qg/7JnMXbbNP6lPi encrypted
passwd 2KFQnbNIdI.2KYOU encrypted <-cisco heh

and decrypt them then telnet into

200.71.78.128 255.255.255.224 outside
or sniff that ip for a password (it's passed in clear text)

and boom i have admin access to your network security device


do this right now

1. disable telnet on the outside
2. Change your passwords
3. if you want outside access to your PIX use SSH (it's a bit more secure) (see thread35-677558 for details on the config)
_________________________________________________________________
remove:

>access-list outside-acl permit tcp any host 200.110.105.195 eq smtp

>access-list outside-acl permit tcp any host 200.110.105.195 eq pop3

>access-list outside-acl permit tcp any host 200.110.105.195 eq www

>static (inside,outside) 200.110.105.195 Correo netmask 255.255.255.255 0 0

__________________________________________________________________
Add:

<access-list outside-acl permit tcp any host 200.110.56.8 eq smtp

access-list outside-acl permit tcp any host 200.110.56.8 eq 110
<access-list outside-acl permit tcp any host 200.110.56.8 eq 80

<static (inside,outside) 200.110.56.8 Correo netmask 255.255.255.255 0 0

_______________________________________________________________________

Note: what is this for??
access-list outside-acl permit tcp any host 200.110.105.195 eq 32000