topic Re: PIX & E-Mail Server Setup? in Network Security

PIX & E-Mail Server Setup?

kendo.igor — Fri, 21 Feb 2020 06:21:34 GMT

We have a Microsoft Exchange server on the inside network. There is no DMZ.

We have access list acl_in bound to the inside interface and acl_out bound to the outside interface.

These are the lines I'm planning to add to the configuration to provide a bidirectional smtp connectivity between the mail server and the internet.

I've omitted the nameif, ip address, interface, and access-group commands, and changed the actual ip addresses.

Does this look correct and do I need to make any changes?

static (inside,outside) 200.1.1.1 10.1.1.1 netmask 255.255.255.255 0 0

access-list acl_out permit tcp any host 200.1.1.1 eq smtp

nat (inside) 101 10.1.1.1 255.255.255.255

global (outside) 101 200.1.1.1 netmask 255.255.255.0

access-list acl_in permit tcp host 10.1.1.1 any eq smtp

Thanx,

Re: PIX & E-Mail Server Setup?

tvanginneken — Wed, 06 Nov 2002 23:35:16 GMT

Hi,

you can skip the nat and the global command. The translation is already done by the static command.

Kind Regards,

Tom

Re: PIX & E-Mail Server Setup?

mshavrov — Fri, 08 Nov 2002 17:36:25 GMT

Answer #1 is correct. You should not use NAT/GLOBAL if you use STATIC. And always remember, that all connections, initiated from INSIDE (in comparation with another interface) are allowed by default, so you should not care about "acl_in" access-list.

Another thing, you didn't state, if you applied ACCESS-LIST to interface with ACCESS-GROUP command. Without this it will not work.

Good luck.