NAT SMTP to alternate internal IP based on source IP - w/Config & diagram

collin.windsor · ‎01-23-2011

I currently deny inbound port 25/SMTP for sources from APNIC, RIPE, AfriNIC & LACNIC; and permit ARIN source IPs on 25/smtp. This works really well and has reduced +99% of UCE/SPAM.

Not that I don't appreciate the sincere offers, but I don't currently need Viagra, university degrees, fake watches or mail order brides.

I would like to "split" this so that instead of denying foreign SMTP, it would go to the alternate spam server, smtp2. This will allow me to fine-tune IPs if needed, by periodically reviewing my "alternate" inbox. I am willing to upgrade PIX if necessary.

Not sure how to do this with a PIX. Can you be the genius that figures it out?

Here is my config, the the first part has been changed:

PIX Version 6.0(1)
hostname pix
domain-name sampleco.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
names
name 192.168.1.11 smtp1
name 192.168.1.12 smtp2
access-list inbound deny tcp 1.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 2.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 3.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 4.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 5.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 6.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 7.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 8.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 9.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 10.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 11.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 12.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 13.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 14.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 15.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 16.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 17.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 18.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 19.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 20.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 21.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 22.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 23.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 24.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 25.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 26.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 27.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 28.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 29.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 30.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 31.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 32.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 33.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 34.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 35.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 36.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 37.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 38.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 39.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 40.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 41.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 42.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 43.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 44.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 45.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 46.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 47.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 48.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 49.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 50.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 51.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 52.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 53.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 54.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 55.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 56.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 57.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 58.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 59.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 60.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 61.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 62.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 63.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 64.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 65.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 66.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 67.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 68.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 69.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 70.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 71.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 72.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 73.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 74.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 75.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 76.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 77.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 78.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 79.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 80.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 81.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 82.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 83.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 84.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 85.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 86.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 87.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 88.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 89.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 90.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 91.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 92.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 93.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 94.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 95.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 96.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 97.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 98.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 99.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 100.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 101.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 102.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 103.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 104.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 105.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 106.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 107.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 108.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 109.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 110.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 111.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 112.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 113.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 114.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 115.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 116.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 117.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 118.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 119.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 120.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 121.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 122.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 123.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 124.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 125.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 126.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 127.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 128.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 129.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 130.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 131.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 132.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 133.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 134.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 135.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 136.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 137.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 138.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 139.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 140.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 141.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 142.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 143.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 144.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 145.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 146.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 147.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 148.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 149.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 150.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 151.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 152.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 153.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 154.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 155.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 156.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 157.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 158.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 159.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 160.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 161.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 162.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 163.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 164.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 165.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 166.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 167.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 168.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 169.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 170.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 171.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 172.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 173.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 174.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 175.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 176.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 177.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 178.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 179.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 180.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 181.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 182.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 183.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 184.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 185.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 186.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 187.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 188.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 189.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 190.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 191.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 192.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 193.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 194.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 195.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 196.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 197.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 198.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 199.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 200.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 201.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 202.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 203.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 204.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 205.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 206.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 207.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 208.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 209.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 210.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 211.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 212.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 213.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 214.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 215.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp 216.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 217.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 218.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 219.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 220.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 221.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 222.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 223.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 224.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 225.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 226.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 227.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 228.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 229.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 230.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 231.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 232.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 233.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 234.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 235.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 236.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 237.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 238.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 239.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 240.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 241.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 242.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 243.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 244.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 245.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 246.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 247.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 248.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 249.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 250.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 251.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 252.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 253.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound deny tcp 254.0.0.0 255.0.0.0 host 202.101.3.131 eq smtp
access-list inbound permit tcp any host 202.101.3.131 eq smtp
access-list outbound permit tcp host smtp1 any eq smtp
access-list outbound permit tcp host smtp2 any eq smtp
access-list outbound deny tcp any any eq smtp
access-list outbound permit tcp 192.168.1.0 255.255.255.0 any eq www
pager lines 24
logging on
logging timestamp
interface ethernet0 10baset
interface ethernet1 10baset
icmp permit 192.168.0.0 255.255.255.0 echo-reply inside
mtu outside 1500
mtu inside 1500
ip address outside 202.101.3.128 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 1.0.0.0 255.0.0.0 outside
pdm location 2.0.0.0 255.0.0.0 outside
pdm location 3.0.0.0 255.0.0.0 outside
pdm location 4.0.0.0 255.0.0.0 outside
pdm location 5.0.0.0 255.0.0.0 outside
pdm location 6.0.0.0 255.0.0.0 outside
pdm location 7.0.0.0 255.0.0.0 outside
pdm location 8.0.0.0 255.0.0.0 outside
pdm location 9.0.0.0 255.0.0.0 outside
pdm location 10.0.0.0 255.0.0.0 outside
pdm location 11.0.0.0 255.0.0.0 outside
pdm location 12.0.0.0 255.0.0.0 outside
pdm location 13.0.0.0 255.0.0.0 outside
pdm location 14.0.0.0 255.0.0.0 outside
pdm location 15.0.0.0 255.0.0.0 outside
pdm location 16.0.0.0 255.0.0.0 outside
pdm location 17.0.0.0 255.0.0.0 outside
pdm location 18.0.0.0 255.0.0.0 outside
pdm location 19.0.0.0 255.0.0.0 outside
pdm location 20.0.0.0 255.0.0.0 outside
pdm location 21.0.0.0 255.0.0.0 outside
pdm location 22.0.0.0 255.0.0.0 outside
pdm location 23.0.0.0 255.0.0.0 outside
pdm location 24.0.0.0 255.0.0.0 outside
pdm location 25.0.0.0 255.0.0.0 outside
pdm location 26.0.0.0 255.0.0.0 outside
pdm location 27.0.0.0 255.0.0.0 outside
pdm location 28.0.0.0 255.0.0.0 outside
pdm location 29.0.0.0 255.0.0.0 outside
pdm location 30.0.0.0 255.0.0.0 outside
pdm location 31.0.0.0 255.0.0.0 outside
pdm location 32.0.0.0 255.0.0.0 outside
pdm location 33.0.0.0 255.0.0.0 outside
pdm location 34.0.0.0 255.0.0.0 outside
pdm location 35.0.0.0 255.0.0.0 outside
pdm location 36.0.0.0 255.0.0.0 outside
pdm location 37.0.0.0 255.0.0.0 outside
pdm location 38.0.0.0 255.0.0.0 outside
pdm location 39.0.0.0 255.0.0.0 outside
pdm location 40.0.0.0 255.0.0.0 outside
pdm location 41.0.0.0 255.0.0.0 outside
pdm location 42.0.0.0 255.0.0.0 outside
pdm location 43.0.0.0 255.0.0.0 outside
pdm location 44.0.0.0 255.0.0.0 outside
pdm location 45.0.0.0 255.0.0.0 outside
pdm location 46.0.0.0 255.0.0.0 outside
pdm location 47.0.0.0 255.0.0.0 outside
pdm location 48.0.0.0 255.0.0.0 outside
pdm location 49.0.0.0 255.0.0.0 outside
pdm location 50.0.0.0 255.0.0.0 outside
pdm location 51.0.0.0 255.0.0.0 outside
pdm location 52.0.0.0 255.0.0.0 outside
pdm location 53.0.0.0 255.0.0.0 outside
pdm location 54.0.0.0 255.0.0.0 outside
pdm location 55.0.0.0 255.0.0.0 outside
pdm location 56.0.0.0 255.0.0.0 outside
pdm location 57.0.0.0 255.0.0.0 outside
pdm location 58.0.0.0 255.0.0.0 outside
pdm location 59.0.0.0 255.0.0.0 outside
pdm location 60.0.0.0 255.0.0.0 outside
pdm location 61.0.0.0 255.0.0.0 outside
pdm location 62.0.0.0 255.0.0.0 outside
pdm location 63.0.0.0 255.0.0.0 outside
pdm location 64.0.0.0 255.0.0.0 outside
pdm location 65.0.0.0 255.0.0.0 outside
pdm location 66.0.0.0 255.0.0.0 outside
pdm location 67.0.0.0 255.0.0.0 outside
pdm location 68.0.0.0 255.0.0.0 outside
pdm location 69.0.0.0 255.0.0.0 outside
pdm location 70.0.0.0 255.0.0.0 outside
pdm location 71.0.0.0 255.0.0.0 outside
pdm location 72.0.0.0 255.0.0.0 outside
pdm location 73.0.0.0 255.0.0.0 outside
pdm location 74.0.0.0 255.0.0.0 outside
pdm location 75.0.0.0 255.0.0.0 outside
pdm location 76.0.0.0 255.0.0.0 outside
pdm location 77.0.0.0 255.0.0.0 outside
pdm location 78.0.0.0 255.0.0.0 outside
pdm location 79.0.0.0 255.0.0.0 outside
pdm location 80.0.0.0 255.0.0.0 outside
pdm location 81.0.0.0 255.0.0.0 outside
pdm location 82.0.0.0 255.0.0.0 outside
pdm location 83.0.0.0 255.0.0.0 outside
pdm location 84.0.0.0 255.0.0.0 outside
pdm location 85.0.0.0 255.0.0.0 outside
pdm location 86.0.0.0 255.0.0.0 outside
pdm location 87.0.0.0 255.0.0.0 outside
pdm location 88.0.0.0 255.0.0.0 outside
pdm location 89.0.0.0 255.0.0.0 outside
pdm location 90.0.0.0 255.0.0.0 outside
pdm location 91.0.0.0 255.0.0.0 outside
pdm location 92.0.0.0 255.0.0.0 outside
pdm location 93.0.0.0 255.0.0.0 outside
pdm location 94.0.0.0 255.0.0.0 outside
pdm location 95.0.0.0 255.0.0.0 outside
pdm location 96.0.0.0 255.0.0.0 outside
pdm location 97.0.0.0 255.0.0.0 outside
pdm location 98.0.0.0 255.0.0.0 outside
pdm location 99.0.0.0 255.0.0.0 outside
pdm location 100.0.0.0 255.0.0.0 outside
pdm location 101.0.0.0 255.0.0.0 outside
pdm location 102.0.0.0 255.0.0.0 outside
pdm location 103.0.0.0 255.0.0.0 outside
pdm location 104.0.0.0 255.0.0.0 outside
pdm location 105.0.0.0 255.0.0.0 outside
pdm location 106.0.0.0 255.0.0.0 outside
pdm location 107.0.0.0 255.0.0.0 outside
pdm location 108.0.0.0 255.0.0.0 outside
pdm location 109.0.0.0 255.0.0.0 outside
pdm location 110.0.0.0 255.0.0.0 outside
pdm location 111.0.0.0 255.0.0.0 outside
pdm location 112.0.0.0 255.0.0.0 outside
pdm location 113.0.0.0 255.0.0.0 outside
pdm location 114.0.0.0 255.0.0.0 outside
pdm location 115.0.0.0 255.0.0.0 outside
pdm location 116.0.0.0 255.0.0.0 outside
pdm location 117.0.0.0 255.0.0.0 outside
pdm location 118.0.0.0 255.0.0.0 outside
pdm location 119.0.0.0 255.0.0.0 outside
pdm location 120.0.0.0 255.0.0.0 outside
pdm location 121.0.0.0 255.0.0.0 outside
pdm location 122.0.0.0 255.0.0.0 outside
pdm location 123.0.0.0 255.0.0.0 outside
pdm location 124.0.0.0 255.0.0.0 outside
pdm location 125.0.0.0 255.0.0.0 outside
pdm location 126.0.0.0 255.0.0.0 outside
pdm location 127.0.0.0 255.0.0.0 outside
pdm location 128.0.0.0 255.0.0.0 outside
pdm location 129.0.0.0 255.0.0.0 outside
pdm location 130.0.0.0 255.0.0.0 outside
pdm location 131.0.0.0 255.0.0.0 outside
pdm location 132.0.0.0 255.0.0.0 outside
pdm location 133.0.0.0 255.0.0.0 outside
pdm location 134.0.0.0 255.0.0.0 outside
pdm location 135.0.0.0 255.0.0.0 outside
pdm location 136.0.0.0 255.0.0.0 outside
pdm location 137.0.0.0 255.0.0.0 outside
pdm location 138.0.0.0 255.0.0.0 outside
pdm location 139.0.0.0 255.0.0.0 outside
pdm location 140.0.0.0 255.0.0.0 outside
pdm location 141.0.0.0 255.0.0.0 outside
pdm location 142.0.0.0 255.0.0.0 outside
pdm location 143.0.0.0 255.0.0.0 outside
pdm location 144.0.0.0 255.0.0.0 outside
pdm location 145.0.0.0 255.0.0.0 outside
pdm location 146.0.0.0 255.0.0.0 outside
pdm location 147.0.0.0 255.0.0.0 outside
pdm location 148.0.0.0 255.0.0.0 outside
pdm location 149.0.0.0 255.0.0.0 outside
pdm location 150.0.0.0 255.0.0.0 outside
pdm location 151.0.0.0 255.0.0.0 outside
pdm location 152.0.0.0 255.0.0.0 outside
pdm location 153.0.0.0 255.0.0.0 outside
pdm location 154.0.0.0 255.0.0.0 outside
pdm location 155.0.0.0 255.0.0.0 outside
pdm location 156.0.0.0 255.0.0.0 outside
pdm location 157.0.0.0 255.0.0.0 outside
pdm location 158.0.0.0 255.0.0.0 outside
pdm location 159.0.0.0 255.0.0.0 outside
pdm location 160.0.0.0 255.0.0.0 outside
pdm location 161.0.0.0 255.0.0.0 outside
pdm location 162.0.0.0 255.0.0.0 outside
pdm location 163.0.0.0 255.0.0.0 outside
pdm location 164.0.0.0 255.0.0.0 outside
pdm location 165.0.0.0 255.0.0.0 outside
pdm location 166.0.0.0 255.0.0.0 outside
pdm location 167.0.0.0 255.0.0.0 outside
pdm location 168.0.0.0 255.0.0.0 outside
pdm location 169.0.0.0 255.0.0.0 outside
pdm location 170.0.0.0 255.0.0.0 outside
pdm location 171.0.0.0 255.0.0.0 outside
pdm location 172.0.0.0 255.0.0.0 outside
pdm location 173.0.0.0 255.0.0.0 outside
pdm location 174.0.0.0 255.0.0.0 outside
pdm location 175.0.0.0 255.0.0.0 outside
pdm location 176.0.0.0 255.0.0.0 outside
pdm location 177.0.0.0 255.0.0.0 outside
pdm location 178.0.0.0 255.0.0.0 outside
pdm location 179.0.0.0 255.0.0.0 outside
pdm location 180.0.0.0 255.0.0.0 outside
pdm location 181.0.0.0 255.0.0.0 outside
pdm location 182.0.0.0 255.0.0.0 outside
pdm location 183.0.0.0 255.0.0.0 outside
pdm location 184.0.0.0 255.0.0.0 outside
pdm location 185.0.0.0 255.0.0.0 outside
pdm location 186.0.0.0 255.0.0.0 outside
pdm location 187.0.0.0 255.0.0.0 outside
pdm location 188.0.0.0 255.0.0.0 outside
pdm location 189.0.0.0 255.0.0.0 outside
pdm location 190.0.0.0 255.0.0.0 outside
pdm location 191.0.0.0 255.0.0.0 outside
pdm location 192.0.0.0 255.0.0.0 outside
pdm location 193.0.0.0 255.0.0.0 outside
pdm location 194.0.0.0 255.0.0.0 outside
pdm location 195.0.0.0 255.0.0.0 outside
pdm location 196.0.0.0 255.0.0.0 outside
pdm location 197.0.0.0 255.0.0.0 outside
pdm location 198.0.0.0 255.0.0.0 outside
pdm location 199.0.0.0 255.0.0.0 outside
pdm location 200.0.0.0 255.0.0.0 outside
pdm location 201.0.0.0 255.0.0.0 outside
pdm location 202.0.0.0 255.0.0.0 outside
pdm location 203.0.0.0 255.0.0.0 outside
pdm location 204.0.0.0 255.0.0.0 outside
pdm location 205.0.0.0 255.0.0.0 outside
pdm location 206.0.0.0 255.0.0.0 outside
pdm location 207.0.0.0 255.0.0.0 outside
pdm location 208.0.0.0 255.0.0.0 outside
pdm location 209.0.0.0 255.0.0.0 outside
pdm location 210.0.0.0 255.0.0.0 outside
pdm location 211.0.0.0 255.0.0.0 outside
pdm location 212.0.0.0 255.0.0.0 outside
pdm location 213.0.0.0 255.0.0.0 outside
pdm location 214.0.0.0 255.0.0.0 outside
pdm location 215.0.0.0 255.0.0.0 outside
pdm location 216.0.0.0 255.0.0.0 outside
pdm location 217.0.0.0 255.0.0.0 outside
pdm location 218.0.0.0 255.0.0.0 outside
pdm location 219.0.0.0 255.0.0.0 outside
pdm location 220.0.0.0 255.0.0.0 outside
pdm location 221.0.0.0 255.0.0.0 outside
pdm location 222.0.0.0 255.0.0.0 outside
pdm location 223.0.0.0 255.0.0.0 outside
pdm location 224.0.0.0 255.0.0.0 outside
pdm location 225.0.0.0 255.0.0.0 outside
pdm location 226.0.0.0 255.0.0.0 outside
pdm location 227.0.0.0 255.0.0.0 outside
pdm location 228.0.0.0 255.0.0.0 outside
pdm location 229.0.0.0 255.0.0.0 outside
pdm location 230.0.0.0 255.0.0.0 outside
pdm location 231.0.0.0 255.0.0.0 outside
pdm location 232.0.0.0 255.0.0.0 outside
pdm location 233.0.0.0 255.0.0.0 outside
pdm location 234.0.0.0 255.0.0.0 outside
pdm location 235.0.0.0 255.0.0.0 outside
pdm location 236.0.0.0 255.0.0.0 outside
pdm location 237.0.0.0 255.0.0.0 outside
pdm location 238.0.0.0 255.0.0.0 outside
pdm location 239.0.0.0 255.0.0.0 outside
pdm location 240.0.0.0 255.0.0.0 outside
pdm location 241.0.0.0 255.0.0.0 outside
pdm location 242.0.0.0 255.0.0.0 outside
pdm location 243.0.0.0 255.0.0.0 outside
pdm location 244.0.0.0 255.0.0.0 outside
pdm location 245.0.0.0 255.0.0.0 outside
pdm location 246.0.0.0 255.0.0.0 outside
pdm location 247.0.0.0 255.0.0.0 outside
pdm location 248.0.0.0 255.0.0.0 outside
pdm location 249.0.0.0 255.0.0.0 outside
pdm location 250.0.0.0 255.0.0.0 outside
pdm location 251.0.0.0 255.0.0.0 outside
pdm location 252.0.0.0 255.0.0.0 outside
pdm location 253.0.0.0 255.0.0.0 outside
pdm location 254.0.0.0 255.0.0.0 outside
pdm logging debugging 512
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 2 202.101.3.150
nat (inside) 2 192.168.1.0 255.255.255.0 0 0
static (inside,outside) 202.101.3.131 smtp1 netmask 255.255.255.255 0 0
static (inside,outside) 202.101.3.132 smtp2 netmask 255.255.255.255 0 0
access-group inbound in interface outside
access-group outbound in interface inside
route outside 0.0.0.0 0.0.0.0 202.101.3.128 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
no floodguard enable
no sysopt route dnat
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum: <removed>
: end

Federico Coto Fajardo · ‎01-23-2011

Hi Collin,

There are other tools to stop SPAM for example replacing the PIX with an ASA and using the Botnet filter or using IronPort S-series solution.

To accomplish what you want with the PIX, I believe that you can use Policy NAT so that you can NAT based on the source of the IP packet.

Federico.

collin.windsor · ‎01-23-2011

Federico, thanks for the quick reply.

Based on searching for Policy NAT, I looked at this http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/bafwcfg.html#wp1113601, but it did not appear to specifically reference my need.

Can you give me a psudo-config or example of Policy NAT based on source IP? Additionally, is Policy NAT available in PIX 506 v6.0(1); and where can I easily obtain a newer flash image?

Thanks again!

Nagaraja Thanthry · ‎01-24-2011

Hello,

Please try the following:

object-group ARIN

access-list pnat1 permit tcp host "SMTP1" eq 25 "ARIN Range"

access-list pnat2 permit tcp host "SMTP2" eq 25 "NON-ARIN Range"

static (inside,outside) 202.101.3.131 access-list pnat1

static (inside,outside) 202.101.3.131 access-list pnat2

Once you configure above lines, now all requests from Non-ARIN addresses will come to the PIX, pix sends that data to second SMTP server. This should acheive what you are looking for. You might have to use an ASA or upgrade the PIX code to latest 8.0(x) to implement this effectively.

Hope this helps.

Regards,

NT

lal.antony · ‎01-23-2011

@Collin,

The best option is to update your PIX to Cisco ASA platform with CSC-SSM module.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6823/product_data_sheet0900aecd80402e4f_ps6120_Products_Data_Sheet.html

Above module does anti-spam and anti-virus checks you want. Also gives you the ability to do whitelists and blacklists.

Cheers

Lal Antony

www.lalantony.com

Federico Coto Fajardo · ‎01-24-2011

Collin,

I would agree with Lal...

Besides you're right... Policy NAT is based on destination (not on source as regular NAT).

Federico.