SMTP static routing question

[jmconsulting]

I am attempting to set up an smtp server behind the 515e on a dmz. I have the dns records (external) pointing to a public IP address. The MX and A records appear to be correct.

The question is when i attempt to trace the public IP address, the trace stops at the last hop before the 515e firewall. I have checked with the T1 provider and IP's x.10 thru x.14 are available. x.10 is the firewall outside interface, x.11 is a static mapping to an internal smtp server.

Is there something that I need to insert in order to be able to get to the exchange box? I have the necessary smtp access list point to the x.11 address, established the dmz, created the static mapping and applied it to the outside interface. Am I missing something?????

Thanks in advance for any info available

 

[ChrisAC]

Maybe because your config doesn't allow it.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[ChrisAC]

icmp *to* the pix is controlled with the 'icmp' key word. So, if you want to allow icmp echo-request (for ping and traceroute') then you can add the command,

icmp permit any echo outside

Ideally you don't want to allow icmp to your firewall from anywhere so I usually limit it to certain management IP addresses.

icmp permit host <mgmt_IP> outside

To test this I've just done a traceroute to a pix that I manage. With the above icmp command I could trace all the way to the pix. When I removed that line the trace stopped at the router in front of the pix.

Chris.



**********************
Chris A.C, CCNA, CCSA
**********************

 

[jmconsulting]

Chris,

I added the line for the icmp echo but still i do not get any reply from the x.11 ip address.

Is there something else that i need to address?

 

[ChrisAC]

Maybe the router is filtering icmp?

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[jmconsulting]

If you are refering to the T1 router, I can ping and trace to the IP address of the pix, I just can't see the exchange server on the back side, even with the static map.

Am I missing something?

 

[ChrisAC]

Add an access-list entry to allow icmp to the global IP address of that box.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************