Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA 5505 LDAP Sync for GFI Max Mail Protection

Having great trouble trying to get my online mail filtering service to sync with LDAP through the Cisco ASA 5505.

Please below for firewall entries.

access-list outside extended permit tcp host GFI1 host SMTP eq ldap

static (inside,outside) tcp SMTP ldap SERVER ldap netmask 255.255.255.255

The below error gets logged on the ASA.

Deny tcp src outside:208.70.89.81/42946 dst inside:SMTP/389 by access-group "outside" [0x0, 0x0]

Have I done something wrong or missing some config entries ?

The server is SBS2008 with LDS installed and configured.

Thank you.

S.

  • Firewalling
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Hi Stephen,

Names are only used for hosts, so they don't accept a subnet mask. In the example you provided, the ASA will try to match the packet to 208.80.78.0.

If you want to specify full subnets, you can use object-groups:

object-group network GFI1

   network-object 208.80.78.0 255.255.255.0

You'll also need to adjust your access-list to use the object-group like this:

access-list outside extended permit tcp object-group GFI1 host SMTP eq ldap

Hope that helps.

-Mike

6 REPLIES
Cisco Employee

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Hi Stephen,

What IP address is configured assigned to the GFI1 name? You can check 'show run name | i GFI1' to see if it is configured for 208.70.89.81.

-Mike

New Member

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Mike,

I've a number of GFIx names assigned to a number of their IP ranges and all are OK.

Thanks.

S.

Cisco Employee

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Stephen,

But does the "outside" access list contain a rule that permits traffic sourced from 208.70.89.81 and destined to the host called SMTP on port 389? The log message you see indicates that the packet isn't matching any of the permit rules in the access list.

-Mike

New Member

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

The GFI name entries are subnets and not hosts, maybe this

is the cause.

E.g. GFI1 is 208.80.78.0 for example.

Would I need to simply add a "mask" entry or is this irrelevant ?

Thanks.

S.

Cisco Employee

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Hi Stephen,

Names are only used for hosts, so they don't accept a subnet mask. In the example you provided, the ASA will try to match the packet to 208.80.78.0.

If you want to specify full subnets, you can use object-groups:

object-group network GFI1

   network-object 208.80.78.0 255.255.255.0

You'll also need to adjust your access-list to use the object-group like this:

access-list outside extended permit tcp object-group GFI1 host SMTP eq ldap

Hope that helps.

-Mike

New Member

Re: ASA 5505 LDAP Sync for GFI Max Mail Protection

Mike,

This got it working.

Many many thanks.

S.

1006
Views
0
Helpful
6
Replies