PIX & E-Mail Server Setup?

[kendo.igor]

We have a Microsoft Exchange server on the inside network. There is no DMZ.

We have access list acl_in bound to the inside interface and acl_out bound to the outside interface.

These are the lines I'm planning to add to the configuration to provide a bidirectional smtp connectivity between the mail server and the internet.

I've omitted the nameif, ip address, interface, and access-group commands, and changed the actual ip addresses.

Does this look correct and do I need to make any changes?

static (inside,outside) 200.1.1.1 10.1.1.1 netmask 255.255.255.255 0 0

access-list acl_out permit tcp any host 200.1.1.1 eq smtp

nat (inside) 101 10.1.1.1 255.255.255.255

global (outside) 101 200.1.1.1 netmask 255.255.255.0

access-list acl_in permit tcp host 10.1.1.1 any eq smtp

Thanx,

[tvanginneken]

Hi,

you can skip the nat and the global command. The translation is already done by the static command.

Kind Regards,

Tom

[mshavrov]

Answer #1 is correct. You should not use NAT/GLOBAL if you use STATIC. And always remember, that all connections, initiated from INSIDE (in comparation with another interface) are allowed by default, so you should not care about "acl_in" access-list.

Another thing, you didn't state, if you applied ACCESS-LIST to interface with ACCESS-GROUP command. Without this it will not work.

Good luck.