Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

PIX 515E- SMTP not working inbound/outbound?

Hi there-

I'm having a problem with some mail reconfiguration.

We've switched from a non-firewalled ISDN connection with one ISP to an ADSL connection with BT (British Telecom) in the UK. I've set up a 1721 for their DSL connection, and am in the process of configuring a 515E internally for them. They're using Exchange 5.5 as their mail server. A new mx has been set up for us with BT.

The problem I'm having is with both inbound and outbound mail. When I attempt to send from the Exchange box using the mx as a relay, it always fails with 'host unreachable'. I've got the ISP to check- they think there's something amiss with the way I've set up port 25 routing- I'm not so sure. Using DNS for outbound mail works perfectly. Inbound doesn't appear to be reaching us at all.

I've set the entire internal domain to a subnet (it used to be publicly available!) They're not using the DMZ for anything at present- plans are for a web server internally at some point. I didn't set the Exchange box in the DMZ, as its also their domain controller and just about does everything else. Could someone have a squint at my 515 config please and do a sanity check? (below)


show running-config

: Saved


PIX Version 6.3(0)136

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security10

enable password notshown encrypted

passwd notshown encrypted

hostname macdonalds515e

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521


pager lines 24

logging on

logging buffered debugging

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside

ip address inside

ip address intf2 x.x.x

ip audit info action alarm

ip audit attack action alarm

no failover

failover timeout 0:00:00

failover poll 15

no failover ip address outside

no failover ip address inside

no failover ip address intf2

pdm history enable

arp timeout 14400

global (outside) 1 netmask

nat (inside) 1 0 0

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum: notshown


Might it be something on the 1721 config? It looks OK to me, but if someone wants to see if both boxes are cooperating with each other, feel free:


macdonalds1721#show running-config

Building configuration...

Current configuration : 1855 bytes


version 12.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption


hostname notshown


enable secret 5 notshown


ip subnet-zero

ip name-server

ip name-server

ip name-server

ip name-server





interface ATM0

no ip address

no atm ilmi-keepalive

pvc 0/38

encapsulation aal5mux ppp dialer

dialer pool-member 1


dsl operating-mode auto

hold-queue 224 in


interface FastEthernet0

ip address

ip nat inside

speed auto


interface Dialer0

ip address x.x.x.x

ip nat outside

encapsulation ppp

dialer pool 1

dialer-group 1

ppp authentication chap callin

ppp chap hostname notshown

ppp chap password notshown


ip nat inside source list 101 interface Dialer0 overload

ip classless

ip route Dialer0

ip route FastEthernet0

no ip http server



access-list 101 permit ip any

access-list 103 deny ip any log

access-list 103 permit udp any any eq netbios-ns log

access-list 103 permit tcp any any eq 139 log

access-list 103 permit tcp any any eq ident

access-list 103 permit tcp any any eq ftp

access-list 103 permit tcp any any eq 8081

access-list 103 permit icmp any any administratively-prohibited

access-list 103 permit icmp any any echo

access-list 103 permit icmp any any echo-reply

access-list 103 permit icmp any any packet-too-big

access-list 103 permit icmp any any time-exceeded

access-list 103 permit icmp any any traceroute

access-list 103 permit icmp any any unreachable

access-list 103 deny ip any any log

dialer-list 1 protocol ip permit


line con 0

line aux 0

line vty 0 4



no scheduler allocate




Beers in it as usual...



Re: PIX 515E- SMTP not working inbound/outbound?

You are currently doing NAT in both places - on IOS, and on the PIX. This will cause all kinds of headaches. You also have no way to forward a port to port 25 of the exchange server.


1. What is the ip address of the exchange box?

2. How many IP addresses to do you get with the DSL line? Just the one on the outside of the IOS device?

New Member

Re: PIX 515E- SMTP not working inbound/outbound?

Hi there Mostiguy-

1)IP address (internal) is The mx created for us is:

2)We get 13 addresses: to .143. I've used 1 for the outside of the DSL, one for the public mx.

thanks- bigger brains than mine needed!


Cisco Employee

Re: PIX 515E- SMTP not working inbound/outbound?


Where is the static/translation for

Where are you gonig to do the translation? on the router or onthe PIX? Where is the permit for tcp/25?

Since you are using ESMTP, you also need to do "no fixup protocol smtp 25"



CreatePlease to create content