Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Forward mail in Pix 501 to exchange server 2003 HELP


We were using pop3 before for our email, but now we have our own exchange server, so what do i need to do inorder for the mail to be forwarded on to our exchange server, which sits behind the pix 501, we are using version 6.3

Thanks for all your help



Re: Forward mail in Pix 501 to exchange server 2003 HELP

smtp (tcp 25) is used for routing email in and out the exchange server; whereas pop3 (tcp 110) or imap (tcp 143) are used for retrieving email by user from the exchange server.


access-list inbound permit tcp any host eq 25

further, one-to-one nat or port forwarding needs to be configured and it depends on the number of public ip you've got.

for one public ip, port forwarding is the only option:

static (inside,outside) tcp interface 25 25 netmask

for multiple public ips, one-to-one static may be configured:

static (inside,outside) netmask

New Member

Re: Forward mail in Pix 501 to exchange server 2003 HELP

I know I didn't start this thread but I have a very similiar problem, so I apologise for hijacking this, hope no one is offended.

I am trying to do the same thing route smtp traffic through to an exchange server behind a PIX506 and a router. the router would appear to be forwarding all traffic to the firewall (as expected) but the firewall refuses to route smtp to the exchange IP.

below are configs of 506.

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxx

passwd xxxx

hostname pixfirewall


fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69


access-list inside_outbound_nat0_acl permit ip any

access-list outside_cryptomap_dyn_20 permit ip any

access-list outside_access_in remark smtp all rule

access-list outside_access_in permit tcp any eq smtp any eq smtp

pager lines 24

logging on

logging console informational

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside

ip audit info action alarm

ip audit attack action alarm

ip local pool vpn

pdm location outside

pdm location outside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0 0

static (outside,inside) tcp interface smtp smtp netmask 0 0

access-group outside_access_in in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

ntp server source outside prefer

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup nyfvo address-pool vpn

vpngroup nyfvo default-domain nyfvo

vpngroup nyfvo idle-time 1800

vpngroup nyfvo password ********

telnet timeout 5

ssh timeout 5

I think I may be a little confused about the structure of the rules as I have setup a SMTP any rule that should allow the smtp traffice access, and a static route through the firewall for the smtp traffic.

I am using the pix device manager to setup rules but this isn't exactly straight forward as far as logically creating rules.

Any help is much appreciated.

CreatePlease login to create content