SMTP in DMZ can't connect to Exchange on Inside

[QCumber]

Hi there,

I have an ASA5505 with Security Plus license, that will eventually host multiple DMZs (OWA, Webserver, etc). Initially, I'm trying to setup a DMZ based SMTP server (Mcafee Webshield) on Interface Vlan146 (nameif DMZ146) that needs to pass mail to an Exchange server on the Inside LAN.

I can make a port 25 connection to the SMTP server from the internet, but it can't connect to the Exchange box. ASDM records the error:

No translation group found for tcp src DMZ146:10.0.146.2/1113 dst Inside:192.168.4.8/25

I'd be much obliged of someone would be good enough to scan my config (below) and tell me what I'm missing.

Cheers,

Q.

=====================================================
ASA Version 8.0(3)
!
hostname Firewall
domain-name xxxx.co.uk
enable password xxxxxxxxxxxxxxxx encrypted
names
name 192.168.4.4 Animal
name 192.168.4.9 Kermit-DC description VM DC on 192.168.4.201
name 192.164.4.0 internallan description Internal LAN
dns-guard
!
interface Vlan83
nameif Outside
security-level 0
ip address 83.67.aaa.bbb 255.255.255.224
!
interface Vlan144
nameif DMZ144
security-level 50
ip address 10.0.144.1 255.255.255.0
!
interface Vlan145
nameif DMZ145
security-level 50
ip address 10.0.145.1 255.255.255.0
!
interface Vlan146
nameif DMZ146
security-level 50
ip address 10.0.146.1 255.255.255.0
!
interface Vlan147
nameif DMZ147
security-level 50
ip address 10.0.147.1 255.255.255.0
!
interface Vlan192
nameif Inside
security-level 100
ip address 192.168.4.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 83
!
interface Ethernet0/1
switchport access vlan 144
!
interface Ethernet0/2
switchport access vlan 145
!
interface Ethernet0/3
switchport access vlan 146
!
interface Ethernet0/4
switchport access vlan 147
!
interface Ethernet0/5
switchport access vlan 192
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd xxxxxxxxxxxxxx encrypted
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns server-group DefaultDNS
domain-name xxxxxx.co.uk
object-group service AD_PORTS_TCP tcp
port-object eq domain
port-object eq 445
port-object eq ldap
port-object eq 88
port-object eq www
port-object eq 135
port-object eq 691
port-object eq 3268
port-object eq 5555
port-object eq 5556
port-object range 1024 65535
object-group service AD_PORTS_UDP udp
port-object eq domain
port-object eq 445
port-object eq 389
port-object eq 88
object-group network SE-Nets
network-object host Animal
object-group network AdminGroup
network-object host Animal
object-group network RDP-group
network-object host Animal
object-group service RDP tcp
port-object eq 3389
port-object eq 3390
object-group service DM_INLINE_TCP_1 tcp
group-object RDP
port-object eq domain
object-group network ALCROOT_DCs
network-object host Kermit-DC
object-group network DM_INLINE_NETWORK_1
group-object ALCROOT_DCs
group-object AdminGroup
object-group network DM_INLINE_NETWORK_2
group-object ALCROOT_DCs
group-object AdminGroup
object-group service Port8080 tcp
description Port80Out
port-object eq 8080
port-object eq www
object-group network DM_INLINE_NETWORK_3
group-object ALCROOT_DCs
group-object AdminGroup
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service DM_INLINE_SERVICE_1
service-object tcp eq 10000
service-object udp eq 4500
service-object udp eq isakmp
access-list Inside_access_in extended permit tcp any host 10.0.144.2 eq https
access-list Inside_access_in extended permit tcp any host 10.0.144.2 eq 3389
access-list Inside_access_in extended permit tcp any any eq www
access-list Inside_access_in extended permit tcp any any eq https
access-list Inside_access_in extended permit tcp 192.168.4.0 255.255.255.0 any eq 3389
access-list Inside_access_in extended permit udp any any eq domain
access-list Inside_access_in remark Allow SMTP traffic from Gonzo(Mailbox) to Scooter(GRPSHL)
access-list Inside_access_in extended permit tcp host 192.168.4.8 host 10.0.146.2 eq smtp
access-list Inside_access_in extended permit icmp any host 10.0.144.2
access-list Inside_access_in extended permit icmp any host 10.0.146.2 echo
access-list Inside_access_in extended permit icmp any any
access-list Inside_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 any object-group DM_INLINE_TCP_1
access-list Inside_access_in extended permit udp object-group DM_INLINE_NETWORK_2 any eq domain
access-list Inside_access_in extended permit tcp any any object-group Port8080
access-list Inside_access_in extended permit icmp object-group DM_INLINE_NETWORK_3 any echo-reply
access-list Inside_access_in remark Allow Usenet Out
access-list Inside_access_in extended permit tcp 192.168.4.0 255.255.255.0 any eq nntp
access-list Inside_access_in remark Allow Cisco VPN Out
access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_1 192.168.4.0 255.255.255.0 any
access-list NO-NAT extended permit ip 10.0.144.0 255.255.255.0 internallan 255.255.255.0
access-list NO-NAT extended permit ip 10.0.146.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list outside_access_in extended permit tcp any host 83.67.aaa.ddd eq https
access-list outside_access_in extended permit tcp any host 83.67.aaa.ccc eq smtp
access-list SMTP remark TEMP - allow all in from SMTP DMZ
access-list SMTP extended permit ip host 10.0.146.2 any
access-list SMTP extended permit tcp host 10.0.146.2 host 192.168.4.8 eq smtp
access-list SMTP extended permit tcp host 10.0.146.2 any eq www
access-list SMTP extended permit tcp host 10.0.146.2 any eq https
access-list SMTP extended permit udp host 10.0.146.2 any eq domain
access-list SMTP extended permit tcp host 10.0.146.2 any eq echo
access-list SMTP extended permit icmp any any echo-reply
access-list OWA_access_in extended permit tcp host 10.0.144.2 any object-group AD_PORTS_TCP
access-list OWA_access_in extended permit udp host 10.0.144.2 any object-group AD_PORTS_UDP
access-list OWA_access_in extended permit icmp any any echo-reply
access-list inside_access_in extended permit tcp any any eq www
access-list Inside_nat0_outbound extended permit ip object-group AdminGroup 10.0.144.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip object-group AdminGroup 10.0.145.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip object-group AdminGroup 10.0.146.0 255.255.255.0
access-list ICMPALC extended permit icmp any any
pager lines 24
logging enable
logging timestamp
logging list Syslog_Warnings level warnings
logging monitor debugging
logging buffered debugging
logging trap errors
logging asdm informational
logging permit-hostdown
mtu Outside 1500
mtu DMZ144 1500
mtu DMZ145 1500
mtu DMZ146 1500
mtu DMZ147 1500
mtu Inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-603.bin
no asdm history enable
arp timeout 14400
global (Outside) 1 interface
nat (DMZ144) 0 access-list NO-NAT
nat (DMZ146) 0 access-list NO-NAT
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 1 192.168.4.0 255.255.255.0
static (DMZ146,Outside) 83.67.aaa.ccc 10.0.146.2 netmask 255.255.255.255
static (DMZ144,Outside) 83.67.aaa.ddd 10.0.144.2 netmask 255.255.255.255
access-group outside_access_in in interface Outside
access-group OWA_access_in in interface DMZ144
access-group SMTP in interface DMZ146
access-group Inside_access_in in interface Inside
route Outside 0.0.0.0 0.0.0.0 83.67.aaa.aaa 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.4.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.4.0 255.255.255.0 Inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access Inside
dhcpd auto_config Outside
!

threat-detection basic-threat
threat-detection statistics
ntp server 139.143.5.31 source Outside
ntp server 139.143.5.30 source Outside
username xxxxxxxxxxx password xxxxxxxxxxxxxxx encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect pptp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:57913f24f99fcdb55298fe519db8acf9
: end

 

[AgentK]

There's a missing STATIC. From your config, there are the assumptions:

Public ip: 83.67.aaa.ccc
smtp relay host in (dmz): 10.0.146.2
smtp server (inside) 192.168.4.8

**Create Static one to one xlate**
Static (DMZ, Outside) 83.67.aaa.ccc 10.0.146.2 netmask 255.255.255.255
Static (Inside, DMZ) 10.0.146.2 192.168.4.8 netmask 255.255.255.255
**permit smtp traffic**
access-list outside_access_in extended permit tcp any host 83.67.aaa.ccc eq smtp
access-list Inside_access_in extended permit tcp host 10.0.146.2 192.168.4.8 eq smtp


**Testing**
-Check make sure port 25 is open to the world by scanning for host 83.67.aaa.ccc port 25 from the internet.(

http://www.t1shopper.com/tools/port-scanner/).

-Test smtp connection from the smtp relay host by telnet to the inside host, i.e..., telnet 192.168.4.8 25 (see instruction below).

*On ASA do*

show access-list to see if there's hit count, show access-list | grep smtp
You should see some hit count if not, check your double check your access list or ip address.


***SMTP Check Port 25 with the Telnet Command***

Open a command line and type

telnet mailserver.domain.com 25

If your server is online a connection will be established on port 25 (SMTP).

An Exchange Server answers with the following output:
220 mailserver.domain.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready at Sat, 22 May 2006 08:34:14 +0200

When you type the ‘help’ command the available commands are listed:

214-This server supports the following commands:
214 HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ATRN ETRN BDAT VRFY

Try the following to send an eMail from the command line:

220 mailserver.domain.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready at Sat, 22 May 2006 09:01:29 +0200
helo myserver.domain.com
250 mailserver.domain.com Hello [10.1.11.133]
mail from:<myname@mydomain.com>
250 2.1.0 myname@mydomain.com....Sender OK
rcpt to:<recipientname@mydomain.com>
250 2.1.5 recipientname@mydomain.com
data
354 Start mail input; end with <CRLF>.<CRLF>
subject: This is a test mail
to: recipientname@mydomain.com
This is the text of my test mail.
.
250 2.6.0 <exchange.domain.com> Queued mail for delivery
quit
*****
Hope this help, let us know how it turns out.

 

[QCumber]

Hi Agentk,

thanks for taking the time to reply in such detail. I'm working out of town this week, but I'll give your fix a try once I return and let you know how I get on.

Cheers,

Q.