Allow smtp through ASA 5510

[Vladimir Bednikov]

Hi All,

I have an ASA5510 running IOS 8.2. I want to experiment with allowing a server on our network to SMTP to our Office 365 exchange service. I have configured the access list on the inside interface to allow our server to telnet out on port 25. Packet-Tracer of the inside interface with our server IP and port 25 to exchange IP and port 25 is successful. Howerver, when I perform a test telnet, it eventually times out and I get a Connect Failed message. Console logging with level 6 only logs the following:

Built outbound TCP connection ####### for outside:<exchange IP>/25 (<exchange IP>/25) to inside:<server IP/<rand port> (<server IP>/rand port)

I have done a tcpdump on the server connected to the outside interface and it sees nothing. I have also temporarily turned off mailguard by issuing the following command:

no fixup protocol smtp 25

However, I have not restarted the ASA. Do I need to restart the ASA for it to take affect?

Edit: I have restarted the ASA 5510 and still the same result as above.

TIA,

Vlad

[Vladimir Bednikov · Accepted solution]

All fixed now. All of a sudden, logging showed "failed to locate next hop for UDP from NP Identity for 65.XX.XX.138. I added a route for it to go to the ISP gateway and it is working now.

Cheers for the various input on how to diagnose the issue.

[Marius Gunnerud]

Interesting.

So that IP address is not a public IP address, or it is located off a different interface than the outside interface on your ASA?  You had a default route so this is quite odd.

route outside 0.0.0.0 0.0.0.0 10.89.30.1

[Vladimir Bednikov]

I think my default route is wrong. It should be pointing to our ISP gateway.