ASA5510 SMTP problems

[Adam Hudson]

Up until recently one of my sites was able to get to a postini subnet. Then we started recieving "host unreachable" e-mails. Postini told us SMTP traffic was not getting let in. I've compared the current config to a config that was saved before the issue popped up and found really no noticeable difference.

I tried a packet tracer trace with no luck:

==============================

SiteB-Firewall# packet-tracer input outside tcp 11.2.2.36 12345 65.19.0.0 25

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   0.0.0.0         0.0.0.0         outside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

============================================

Attached is a sanitized config. I'm not entirely convinced it's a firewall issue, but I need to some successful testing to prove otherwise.

[Adam Hudson]

Reconfigured NAT to use seperate public IP addresses for our mail (SMTP) and RDP, using the following commands on the existing config:

===============

no static (inside,outside) tcp interface 3389 11.22.33 3389 netmask 255.255.255.255

no static (inside,outside) tcp interface smtp access-list postini-nat

static (inside,outside) 25.107.253.4 11.22.33 netmask 255.255.255.255

static (inside,outside) 25.107.253.5 11.22.36 netmask 255.255.255.255

access-list incoming extended permit tcp any host 25.107.253.4 eq 3389

access-list incoming extended permit tcp 65.19.0.0 255.255.240.0 host 25.107.253.5 eq smtp

access-list incoming extended permit icmp any any

access-group incoming in interface outside

=================

These commands did not let the mail through. In addition, after restarting the router, now the firewall can't get to anything on the internal network and I can't remote directly into it. I have to telnet into it through the local router.

Attached is sanitized config of that router. I need to figure out why the mail isn't getting through and additionally why now the firewall can't get into the internal network.

[Adam Hudson]

Ping results:

Router to inside int of Firewall: Good

Rtr to outside int of FW: Good

Rtr to IPS address (past FW): Good

Firewall to router on int that connects the 2: Good

FW to RTR int on the internal network: Fail

FW to RTR's mpls port: Fail

FW to internal network address (it's own Site): Fail

FW to internal network address (another site): Fail

[Adam Hudson]

Tried "clear xlate", have not power cycled the ASA though.

More output:

SiteB-Firewall# sh eigrp neighbors

EIGRP-IPv4 neighbors for process 102

H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq

                                            (sec)         (ms)       Cnt Num

0   11.255.2.2              Et0/1            14  19:25:28 2    200   0   11

=-=

SiteB-Firewall# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default, U - per-user static route, o - ODR

       P - periodic downloaded static route

Gateway of last resort is 25.107.253.1 to network 0.0.0.0

C    25.107.253.0 255.255.255.248 is directly connected, outside

C    11.255.2.0 255.255.255.252 is directly connected, inside

S*   0.0.0.0 0.0.0.0 [1/0] via 25.107.253.1, outside

=-=

SiteB-Firewall# sh eigrp topology

EIGRP-IPv4 Topology Table for AS(102)/ID(25.107.253.3)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,

       r - reply Status, s - sia Status

P 0.0.0.0 0.0.0.0, 1 successors, FD is 28160

        via Rstatic (28160/0)

P 11.255.2.0 255.255.255.252, 1 successors, FD is 2816

        via Connected, Ethernet0/1

[Adam Hudson]

Complete updated ASA config attached.