topic PIX 515 Mail not working in Network Security

PIX 515 Mail not working

dmox — Fri, 21 Feb 2020 07:38:03 GMT

We're having an issue where we can't send mail to ourselves. Mail will successfully come from outside sources to mail.domainname.com but if we try it internally it won't allow the traffic through. If I try to telnet to port 25 from a machine on the internal network to the mail.domainname.com then it doesn't connect. However, if I telnet from an external source (one that isn't on the Internal Interface) I can connect fine.

Any help would be appreciated

Re: PIX 515 Mail not working

dmox — Thu, 16 Sep 2004 19:44:11 GMT

Here's a relevant portion of my config:

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security10

access-list 100 permit tcp any host xxx.xxx.xxx.217 eq smtp

access-list 100 permit tcp any host xxx.xxx.xxx.217 eq pop3

global (outside) 1 interface

global (dmz) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

alias (inside) 192.168.0.xx xxx.xxx.xxx.4 255.255.255.255

static (inside,outside) xxx.xxx.xxx.217 192.168.0.xx netmask 255.255.255.255 0 0

Re: PIX 515 Mail not working

a.awan — Thu, 16 Sep 2004 20:14:29 GMT

Your alias does not match your smtp server's public IP address. I am assuming the alias you have set is for the smtp server?

Re: PIX 515 Mail not working

jmia — Fri, 17 Sep 2004 09:58:08 GMT

Daryl,

As per Atif's post change your alias to:

alias (inside) 192.168.0.xxx xxx.xxx.xxx.217 255.255.255.255

static (inside,outside) xxx.xxx.xxx.217 192.168.0.xxx netmask 255.255.255.255 0 0

Remember to issue clear xlate after the modifications and save with write mem.

Re: PIX 515 Mail not working

dmox — Fri, 17 Sep 2004 12:08:24 GMT

Is the alias mandatory? What if I remove it completely?

Re: PIX 515 Mail not working

a.awan — Fri, 17 Sep 2004 12:13:44 GMT

The alias will be required if you are trying to talk to your mail server using its public hostname. What the alias command does is that it doctors the DNS replies coming through the PIX and basically changes the public ip address into the private ip address for your internal clients. You can say that your internal DNS queries for your mail server will return its private rather than public ip address and this should make things work for you.