Update:Current working Configuration.... All seems to work, but too well.
When I run a Portscan on my email IP it shows 25,993 and 143 enabled... All Email Ports. But, in my Cisco I only allow Incoming 993 for IMAP/SSL.
I went into my Linux Firewall and it indeed has 143 Opened, which I wanted. But in LINUX when I remove it from firewall and redo Portscan, it shows closed.
So, I am thinking this configuration is not set up correctly as my Linux Email still depended on itself to close 143
My only suggestion to myself is where I have;
--------------------------------------
policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
class type inspect OUTSIDE-TO-INSIDE-CLASS
inspect
class class-default
pass
------------------------------------------
---- is the PASS allowing everything?
class-map type inspect match-all INSIDE-TO-OUTSIDE-CLASS
match access-group name INSIDE-TO-OUTSIDE
class-map type inspect match-all OUTSIDE-TO-INSIDE-CLASS
match access-group name OUTSIDE-TO-INSIDE
!
policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
class type inspect INSIDE-TO-OUTSIDE-CLASS
inspect
class class-default
pass
policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
class type inspect OUTSIDE-TO-INSIDE-CLASS
inspect
class class-default
pass
!
zone security INSIDE
zone security OUTSIDE
zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
service-policy type inspect INSIDE-TO-OUTSIDE-POLICY
zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE
service-policy type inspect OUTSIDE-TO-INSIDE-POLICY
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
description TPLink Wireless
no ip address
!
interface GigabitEthernet1
description Email Server
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
description PPPoE xDSL WAN
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
!
interface Vlan1
ip address 207.108.121.182 255.255.255.248
ip nat inside
ip virtual-reassembly in
zone-member security INSIDE
!
interface Async3
no ip address
encapsulation slip
!
interface Dialer1
description PPPoE xDSL WAN Dialer
ip address negotiated
no ip unreachables
ip mtu 1460
ip nat outside
ip virtual-reassembly in
zone-member security OUTSIDE
encapsulation ppp
ip tcp adjust-mss 1420
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname *******
ppp chap password 0 *******
ppp pap sent-username ******* password 0 ******
ppp ipcp route default
no cdp enable
!
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
!
ip nat inside source list 1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended INSIDE-TO-OUTSIDE
permit tcp 207.108.121.0 0.0.0.255 any eq www
permit icmp 207.108.121.0 0.0.0.255 any
permit tcp 207.108.121.0 0.0.0.255 any eq domain
permit udp 207.108.121.0 0.0.0.255 any eq domain
permit tcp host 207.108.121.180 any eq smtp
ip access-list extended OUTSIDE-TO-INSIDE
permit icmp 207.108.121.0 0.0.0.255 any
permit tcp 207.108.121.0 0.0.0.255 any eq domain
permit udp 207.108.121.0 0.0.0.255 any eq domain
permit tcp host 207.108.121.180 any eq 993
!
dialer-list 1 protocol ip permit
!
access-list 1 permit 207.101.121.182
