Locking down SMTP port to accept only from an external IP range to exchange server

[SAM KAWTHARANI]

Hi

My Client have a UC560 and they are inplementing and exchange server which is pointed to an external hosted Spam filtering ccompany (McAfee), the client wants only his server to accept mail from the hosted source which they have provide a range of IP (208.65.144.0/21 and 208.81.64.0/22),

as an intrerim I have opent port 25 to any any (ip nat inside source static tcp xxx.xxx.xxx.xxx 25 interface GigabitEthernet0/0 25) and added to outside ACL the foolowing statement (access-list 104 permit tcp any host 119.xxx,xxx,xxx eq smtp log)

your assistance would be appreciated

[Ryan-Kramer]

- Your NAT statement will stay the same

- Remove permit tcp any host 119.xxx,xxx,xxx eq smtp log from access-list 104

access-list 104 permit tcp 208.65.144.0 0.0.7.255 host 119.x.x.x eq 25 log
access-list 104 permit tcp 208.81.64.0 0.0.3.255 host 119.x.x.x eq 25 log

Where 119.x.x.x is your inside global address.

[SAM KAWTHARANI]

Thanks Ryan for the reply, I will check it today