Zone based firewall block smtp

[cemil.heyderov]

i dear friends, i have exchange server 2016 and this server connect to internet via cisco router 2911, when users send mail with attachment these mail stay in queue exchange server.but when i turn of zone based firewall mails send normaly.help plz.how can i resolve thise problem?

[cemil.heyderov]

my config out to in on zone based firewall

Zone-pair name sdm-zp-NATOutsideToInside-1
Source-Zone out-zone Destination-Zone in-zone
service-policy sdm-pol-NATOutsideToInside-1
policy-map type inspect sdm-pol-NATOutsideToInside-1
class type inspect sdm-nat--1
inspect
class class-default
drop
class-map type inspect match-all sdm-nat--1
match access-group 101
match protocol tcp
Extended IP access list 101
10 permit tcp any host 10.10.0.9 eq smtp
20 permit tcp any host 10.10.0.9 eq 443

10.10.0.9 ip adress exchange server

[ppreenja]

Hi Cemil,

The issue might be occurring since you have enabled SMTP inspection in your zone-based firewall as below:

class type inspect sdm-nat--1
inspect

I would request to disabled the inspection in your zone-based firewall and hopefully it will help resolve your issue.
You can refer to below article for details on inspection zone-based firewall:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/15-mt/sec-data-zbf-15-mt-book/sec-zone-pol-fw.html

I hope the above information helps.

Cheers,
Pratham

[cemil.heyderov]

Thank for link but i read.i can not understant what is incorrect on my config.because some domain i can send mail with attachment some i cannot.on my config i have not filter.and what blocked send mail

[cemil.heyderov]

i read this link thank a lot.but i cannot understant why only mails with attachment cannot go throw router some domains?

examle i can send emal with attachment xxx.com but cannot yyy.com

[cemil.heyderov]

i write acl permit ip any host ip_adress_domain   and add this acl to class map. class map add to policy --pass

zone-pair source in dest out. but result is same