SMTP access to DMZ

[psolis]

what access-list do I need to set up to allow smtp access to my dmz? I set up an Exchange server and pointed the DNS records to the static Ip and I am able to send out mail but when someone replies to it, the mail gets lost in outer space. I believe that because the MX records are pointing to the static IP, the mail is getting dropped because I don't have SMTP access open on the PIX - does this sound correct?

 

[ChrisAC]

access-list mail_in permit any host mail_srv eq 25
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[psolis]

That didn't seem to work - don't I need an access list number like 100 or something and aren't I supposed to run a access-group command after that? Not sure but I thought I saw something like that.

 

[ChrisAC]

Yeah .. you need an acces group command to apply it to the outside interface! Sorry, I presumed that you knew that!

access-group mail_in in interface outside

Also, substitute mail_srv for the IP address of your mail server, the global one.

So, traffic from anywhere is allowed in to the host mail_srv on port 25.

Chris.

************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[psolis]

what I had done that didn't work for me in the sense that when I applied the access-group, I lost all access to surf the web.


access-list acl_out permit tcp any host 65.45.x.x eq smtp
access-group acl_out in interface outside


I found this on page 2-32 of the PIX Version 5.1 manual.
Didn't work

I noticed yours said mail_in where I had acl_out. Is this a version specific command or does it also work.
And most importsntly that I lost ability to surf the web - as if nat stopped working for the outside.

 

[psolis]

Chris - I just used
conduit permit tcp host 65.45.x.x eq smtp any
and it worked.

Tnanks for your help - I could still use your knowledge on the alis question I posted - Paul

 

[ChrisAC]

The conduit statement does the same thing as the access list! Well done!!

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************