Need ACL Assistance for SMTP

[techinneed]

All,

First thanks for any help given.

I am trying to configure my ASA5505 to allow SMTP relay and the ACL\Static I created is not working.

Here is the config:

ASA Version 8.2(2)

!

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.2 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 12.12.12.1 255.255.255.248 --> Suppressed

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

speed 100

duplex full

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 3

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list 101 extended permit tcp any host 12.12.12.1 eq smtp

access-list inside_access_in extended permit ip any any

access-list nonat extended permit ip any 10.10.10.0 255.255.255.0

pager lines 24

logging enable

logging buffered debugging

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface smtp 192.168.1.5 smtp netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 12.12.12.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global-policy

class inspection_default

  inspect icmp

class class-default

!

prompt hostname context

Please help me :-(

Many thanks!

[mirober2]

Hi Jim,

The static PAT looks good but I don't see the "outside_in" ACL defined in the config as specified in the 'access-group' command. In 8.2 you need something like this:

access-list outside_in permit tcp any interface outside eq smtp

or

access-group 101 in interface outside

If that still doesn't work, check the output of 'packet-tracer in outside tcp 1.2.3.4 12345 12.12.12.1 25'

-Mike

[techinneed]

Thanks Mike!

I added the ACL and tested the connection via packet-trace and it went through okay. 

Being that it is for SMTP, I was thinking of using network objects but there are so many versions.  I have 8.2.2 and couldn't figure it out.

How does using network object/ACL/Static ?  If you can point me in the right direction, that would be great.

Thanks again and HAPPY NEW YEAR!

[mirober2 · Accepted solution]

Hi Jim,

The configuration guide will provide some basic examples for configuring object-groups:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/objectgroups.html

Single network objects are only available in 8.3 and higher. However, an object-group in 8.2 can certainly contain a single member.

-Mike