Cisco Firewall :: ASA 8.6 Nat And Access List For Mail Server?

Oct 30, 2012

Trying to figure this all out. I'm getting untranslated hits. I posted the config I have so far.

View 7 Replies


Cisco Firewall :: ASA 5510 / Add A Mail Server In The LAN And A Webmail Using Port 3000 On The Server?

Jul 24, 2011

I'am using ASA 5510 and I try to understand how PAT is working.I want to add a Mail Server in the LAN and a webmail using port 3000 on the server. ( webmail must be reachable from the WAN)This is my Configuration :actually LAN users access internet using NAT with one global IP ( 194.x.x.69) which is the ASA WAN interface.

WAN ----- ISP Router ----------     FW     ---------- LAN -------- Mail Server + Webmail
|             (25) | (3000)
I need to forward port 3000 and port 25 from outside to inside.For example, from the WAN : [URL] must be redirect toward . What is the Correct Configuration ? And what about the Inside/Outside Traffic,Is there any configuration to add ?

View 2 Replies View Related

Cisco Firewall :: Distant Mail Server Not Working On ASA5510

Jun 15, 2011

My mail server is not in my network, it's over internet elsewhere.After installing the ASA 5510, i can not get my mails any more.

View 7 Replies View Related

Cannot Locate E-mail Contacts List?

Aug 8, 2011

I cannot locate my e-mail contacts list.

View 1 Replies View Related

Cisco Firewall :: Access-list On ASA5520

Feb 23, 2011

I have a question about access-lists on ASA: (5520 running 8.4)Often I want to permit all traffic from networks behind an interface (let's say DMZ in this example) to Internet, but NOT to internal networks. Then I  first configure a Deny from DMZ to all internal network and then a Permit to ANY. If I forget the first Deny I will allow all traffic also to my internal networks. Is it possible to configure an access-list that permit all traffic from a network to all networks that are reachable via a given interface? In this example: Permit all traffic from DMZ to all networks that are reachable via the Outside-interface? This should permit traffic to Internet and deny traffic to internal networks in one statement.If I specify the outside-interface as the destination only traffic to the interface itself will be allowed.

View 1 Replies View Related

Cisco Firewall :: PIX 501 With 1 Static IP / NAT / PAT With Access List

Aug 24, 2011

I am having a problem getting this to work and I have always done it with 2 Static ip address.  but now this company changed to 1 and I am doing something wrong.

I have comcast with 1 static IP, I have a local LAN with 6 host and 1 server that does Mail and remote access and web traffic.

I need a config that allows me to use 1 static ip on the outside interface of the PIX and allow with an ACL 7 ports open to the server and allow all the local host out to the internet.

View 11 Replies View Related

Cisco :: Router Outside Firewall / Access List On Interface?

Apr 2, 2013

I have a router in front of a few firewalls on an internet link. All traffic from the inside network must go through one of the firewalls to get out through the router and similarly there is a dmz on one of the firewalls.I am trying to make sure the router is fully hardened.Should I apply an access list on the outside interface of the router along with the access list for management access?

View 11 Replies View Related

Cisco Firewall :: ASA 8.4 Access List Dynamic Interface?

Mar 11, 2013

This is a working example using static. But it doesn't work with the dynamic interface or I'm doing something wrong. Need to get rdp access to my laptop.
ASA Version 8.4(5)6
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted


View 1 Replies View Related

Cisco WAN :: 2921 - CBAC Firewall Access List

Jul 1, 2011

I need to configure the access list on the outbound internet port to accept the following:
ip access list 10
access-list 10 permit PPTP vpn any
access-list 10 permit RDP any
access-list 10 permit FTP any
access-list 10 permit Postgresql any
access-list 10 permit MacARD any
This method does not work on the Cisco 2921 router with FW

View 1 Replies View Related

Cisco Firewall :: ASA 9.1 Access-list / Real IP Addresses?

Feb 26, 2013

So in the past from 8.2 down I had one to one NATs like so
static (inside,outside) A.A.A.A B.B.B.B netmask
but for 9.1 im running now I need to do this
object network obj-B.B.B.B
host B.B.B.B
nat (inside,outside) static A.A.A.A
So if I make an ACL to permit outside public access to the public IP (A.A.A.A) in 9.1 do I use real B.B.B.B ip address or the object itself obj-B.B.B.B?

View 4 Replies View Related

Cisco Firewall :: 2950 Switch Access-list On Dmz

Mar 4, 2012

On firewall we have zone created for dmz and ip is 192.x.x.x and it is connected to 2950 switch(DMZ switch)  with vlan 25..We have L3 switch on this we have created vlan 25 and connected cable from L3 with 2950 switch with vlan 25
As we have the servers on L3 and wanted to bring on dmz zone  we have connected a cable.Now the problem is when i connect a pc on 2950 switch (directly on dmz switch) with access-list below we are not geeting any hist on it.

View 6 Replies View Related

Cisco Firewall :: 5510 Access List For Remote Vpn Users

Apr 5, 2011

How to designate access-list for the remote access vpn users in order to let them access specific subnet or host,asa 5510 and acs is in the picture

View 9 Replies View Related

Cisco Firewall :: Configure Extended Access List On AS5350XM?

Sep 14, 2011

I'm trying to configure an extended access list on one AS5350XM but I get one way hearing on a voice calls and I can't determine why (please see the attached diagram). There is an OSPF running on both gigabit interfaces and the Loopback address is also advertised (it is actually the voip IP address). The access list is applied on both interfaces in the inbound direction. There is another gateway with IP: (no firewalls here) and the routing between gateways is working properly.
Here is part of the access list (applied on AS5350):

permit ip host host
When I review the log of the AS5350xm I see many errors like this one:

%SEC-6-IPACCESSLOGP: list example denied udp ->, 1 packet
So how it is possible to see this error since the access list is in inbound direction and the IP address ( is open. I don't have problems when I do telnet or ssh from to

View 3 Replies View Related

Cisco Firewall :: 6513 - Unable To Remove Access List

Mar 22, 2012

I am unable to remove an access list. Currently this this access list contains 4 lines of remarks. I was unsure if I was entering the command correctly and now I have 4 lines of "trash" that needs to be removed.
     The "sh run" command shows that I have access-list 100 defined.
     The "sh access-list" returns nothing.
Process I have tried:      config t
     no access-list 100
     no access-list remark Test (just trying anything at this point)
    clear configure access-list 100 (This returns "Invalid input detected at '^' marker" and the '^' is under the 'e' in clear.) 
So the "clear configure" command is not working.  The "no access-list" commands does not return an error but does not remove anything.
What step am I missing? Let me know if I can provide any more information.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Vlans Routing & Access-list?

Jan 4, 2012

ASA 5505 vlans routing & access-list?

View 4 Replies View Related

Cisco Firewall :: ASA 5510 / ASA 8.3 Migration - Expanded Access List

Apr 24, 2011

I have just upgraded a ASA5510 from 8.2 to 8.3 using migration tool.All seemed to go well, still double checking the config as this is a bench test of upgrade prior to filed upgrades.
Anyway one thing that is slightly frustrating is that the migration has expanded all of my access-lists, so we maybe had 10 lines of config relating to access-lists based on access-groups, now we have hundreds of lines.On ASDM this is bad enough but on CLI with show run its a bit of a bind.
Is there any way to un-expand the access list or do I simply delete and start again using my access groups.

View 2 Replies View Related

Cisco Firewall :: 5540 - Extended Access-list Error Using FQDN

Nov 7, 2011

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host. For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. and
This is how I normally add these rules (the ip addresses are fictive): access-list internet_access extended permit tcp host host eq www log
When I try to add this using the hostname on our asa I get an error: access-list internet_access extended permit tcp host host  ?ERROR: % Unrecognized command
I've tried it without the 'www', so but same error.

View 4 Replies View Related

Cisco Firewall :: 2801 - Access List Works Only If Word Log Presents?

Jun 27, 2011

I have very strange behaviour on my Cisco 2801 router when I applied access list on wan interface.
SIP Provider <----> Cisco 2801 <-----> CUCM 6
We are using Cisco 2801 as Voice gateway for CUCM 6. so only one purpose of this router is just receiving calls on sip dial-peer and transfering to internal network.
If you look on access list below, if 'log' words don't present on these 2 lines, access list didn't work. Problem with it is that when I establish call from us or to us I can't hear incomming RPT stream, but other side can hear me. But when I type word 'log' there, everything stars working immediately.
Cisco 2801 IOS version:
Cisco IOS Software, 2801 Software (C2801-ADVENTERPRISEK9_IVS-M), Version 12.4(6)T9, RELEASE SOFTWARE (fc2)


View 5 Replies View Related

Cisco Firewall :: ASA 5510 ASDM Show Log On Access-list Empty

Mar 14, 2013

I created some acess-lists, and you can assign a logging level to this access-list. Now this ACL has a lot of hits, so i want to see whats happening. Only the log I then see is completely empty. I cannot figure out how to get some info in that log.
I think there is some global logging setting i probably need to enable in order to get anything logged at all, but i cannot figure out which.

View 4 Replies View Related

Cisco Firewall :: Access List Object Name Substitution ISR871 And ASA5520

May 10, 2011

I am troubleshooting a s2s vpn between an ISR871 and my ASA5520 and I suspect a problem with my crypto-maps.
Is there a way I can display an access-list on the ASA and have the object names substituted with their IP addresses?

View 5 Replies View Related

Cisco Firewall :: FWSM Version 3.2 - No Access-list Line X Doesn't Work

Dec 10, 2011

I am trying to remove a line in a particular access-list configured in a FWSM module using this command "no access-list <acl> line 19 x x x x" but it doesn't work. See below:
FWSM/xxx03(config)# no access-list ?
 configure mode commands/options:
  alert-interval  Specify the alert interval for generating syslog message
106001 which alerts that the system has reached a deny

How can I remove a line from the access-list without clearing the entire access-list?

View 3 Replies View Related

Cisco Firewall :: 5505 - Construct An Access List For Outside Interface Using External Address?

Sep 10, 2012

I'm configuring a 5505 for a remote office.  Until they are assigned a static ip by the provider I will have to use the providers dhcp address. How do I construct an access list for the outside interface using the external address if I don't know it yet? is there a commnd that will insert the ip address in to the access list once one is assigned?

View 5 Replies View Related

Cisco Switching/Routing :: 3560 - No Access List On Switches And No Firewall Between Sites

Jul 15, 2012

I have 3 3560 switches which are configured with trunks between them. They run vlan 10, 11 & 12. I have a 'core' switch (switch 1) of these 3 to which an MPLS router is connected on vlan12. I in addition have another switch hanging off the 'core' switch via a routed link (switch 4). I have EIGRP configured as a stub and as such the IP address on the routed link at the core switch end is of a /24 from v lan 1 on the other switch. This makes the route directly connected and therefore distributed via EIGRP stubs. Switch 1 is then exchanging routes with the MPLS router (via EIGRP).
The problem I have is that from any sub net on any switch (switch 1, 2 or 3) I can ping (switch 4). When I try and ping switch 4 from over the MPLS I am unable to. If I trace to the switch I see it reaches the outside of the MPLS router, but is then unresponsive. The same applies if I try to ping switch 1 on Any of the other IP addresses of switch 1 respond.
The MPLS network is a managed solution to which I have no access. I'm told that the MPLS provider is able to ping switch 1 & switch 4 on the 192.168.13.x addresses from a remote router ( I have tried from a switch on the same L2 sub net ( and I don't get a response.
From switch 4 I am able to ping the switch on 1 of it's interfaces (, but not the interface I mentioned above There are no access lists in place on the switches and no firewalls between the sites.

View 22 Replies View Related

Cisco Firewall :: Access-List Traffic Control Attempting To Block RDP 3389

Nov 7, 2012

I have an ASA pair configured to replace a router that hosts a collection of IPSec Tunnels.  Tunnels appear to work.  I am lab'ing some additional controls that I would like to implement.  On the Production Router that i plan to replace with the ASA's the current Tunnels are all wide open (all traffic allowed to pass).  I was hoping to lock things down a little without having to reconfigure all of the Tunnels.  My though was that an ACL on the Inside Interface blocking selected traffic Out (so into the LAN) should not impact the stability of the Tunnels but allow me to restrict some traffic from entering the LAN.  One port that I was attempting to block is RDP 3389.  When this ACL is applied to the inside interface it does not block Port 3389 at all.  What am I missing?  Is it that the trffic is being allowed because it is coming through one of my 'open' Tunnels? 
Shouldn't IPSec Tunnel traffic be processed by the Inside Interface ACL just like all other traffic?
access-list 145 deny   tcp eq 3389
access-list 145 deny   tcp eq 135
access-list 145 deny   tcp eq 137
access-list 145 deny   tcp eq 138
access-list 145 deny   tcp eq 139
access-list 145 deny   tcp eq 445
access-list 145 deny   tcp eq 389
access-list 145 permit ip any any
ip access-group 145 out interface Internal
This work great on a 2821 Router, but not so much on the ASA.

View 11 Replies View Related

Cisco :: Dual ISP On A 5510 With Static Nat To A Mail Server?

Sep 2, 2011

Only trying to have the mail server reachable via the secondary ISP link if the primary ISP link goes out. The public MX records with priority markings should make it so any outside hosts tries the first ISP address then the second ISP address if the first is unavailable. I would be using object tracking to control the default gateway in the ASA. I'm just a bit fuzzy on the NAT with a dual ISP config on single box.It shouldn't happen but... if traffic comes in on ISP2 while ISP1 is still up (and the current default gate) that traffic should return out the ISP2 interface (using the ISP2 address and avoiding asymmetric routing) since there already an existing connection present inside the ASA. Any server initiated traffic would still use the current default gateway defined via object tracking on the ASA.

View 1 Replies View Related

Cisco WAN :: Get Mail Server On Port 443 From Internal Network

May 24, 2012

I write here to see if some kind soul can not solve my problem (which is common to seeso many people around the world). problem: I have a mail server ( configured static NAT because it is accessible byPublic IP (PPP.PPP.PPP.PPP). Everything works properly from the outside, but if I get my Mail server (on port 443) from the internal network ( there 'verse. This configuration is called Nat inside-to-inside is done by default by some SOHO routers(such as the TPLINK from 25 euros) but Cisco did not succeed. I search on the internet for 2 days without a get nowhere. PS: I have a Cisco 1801 router. (or 1941 as another router).

View 13 Replies View Related

Cisco WAN :: 887 ADSL Configuration With Static NAT For Mail Server?

Feb 8, 2012

I have configure 887 ADSL router with attached configuration. But users cant access internet properly. (Ex: yahoo and gmail mail cant access)

View 8 Replies View Related

Servers :: Reaching Mail Server Outside Router

May 28, 2012

i have a network setup like the image in the link(url) and am asking how to make the PC's behind the router to reach the mail server??,when i ping the ip of the server i get timeout.

View 1 Replies View Related

Mail Server Giving Different IP When Pinged At Different Times

Mar 14, 2012

When I'm pinging my mail server, it gave me different IP's at different times. As the mail server is actually owned by us, I would like to know if that is possible without the IP actually being changed by someone. This is really critical for me. I didn't mean to cross post so providing the URL of the other place where I posted..

If you'd like I may attach the screenshots for the same, but don't think that will server any purpose.

View 7 Replies View Related

Cisco WAN :: ASA 5510 - Mail Server Error 421 SMTP Connection Went Away

Oct 11, 2011

I've got some problem with my Mail Server since I've migrated to an ASA5510.Actually the server is in a DMZ with a private Ip ( 10.x.x.2) and it is translated to a Public IP ( 194.x.x.65).I use these configuration :

static (DMZ,LAN) 194.x.x.65 10.x.x.2 netmask static (DMZ,LAN) 194.x.x.66 10.x.x.3 netmask static (DMZ,WAN) 194.x.x.65 10.x.x.2 netmask static (DMZ,WAN) 194.x.x.66 10.x.x.3 netmask static (LAN,DMZ) netmask
Some Users received in there mailbox a system administer error message :

Object : Impossible to deliver : test Your message could not be deliver to one or more of its recipients: 421 SMTP connection went away!
When they try to re sent it some times later, message is sent without problem.

View 4 Replies View Related

Servers :: Mail Server Showing Multiple IP's When Pinged?

Mar 14, 2012

When I'm pinging my mail server, it gave me different IP's at different times. As the mail server is actually owned by us, I would like to know if that is possible without the IP actually being changed by someone.

View 8 Replies View Related

Cisco Routers :: RV042 Email Server Not Send Mail When Switch From Wan

Sep 28, 2011

Just installed a RV042 with dual wan connections. Would like to make the WAN 2 (new cable modem as well) the primary connection over WAN1 (DSL), however whenever I switch from WAN1 to WAN2 in Smark Link set up, our email server will not send mail out, even though nothing is blocking the connection.

View 0 Replies View Related

TP-Link 3G/3.75G Router :: TL-MR3420 / Fail To Connect Mail Server

Mar 10, 2013

Region : Denmark
Model : TL-MR3420
Hardware Version : V2
Firmware Version : 3.13.27 Build 121206 Rel.60215n

I have a TL-MR3420 router placed in a remote location. The internet connection is via 3G, and since the telco is shifting the IP every 24 hours, the router is configured with DDNS from This is working OK most days, but sometimes the DNS fails to update. To be able to trobleshoot it, I am trying to make my router send a mail with the logfile every hour. This function seems to be easy and out-of-the-box, but it doesn't wiork. Whenever I try to mail the log I get the error message "Fail to Connect the mail server.".

It is not possible to enter another SMTP-port, so I asume the standard port 25 (like this thread). Most ISP-mail services require SSL/TLS and/or use an alternative port, so I have made my own server. This server is visible on the Internet, and I (and others) are able to connect and send mails using smtp on port 25. But, still my remote TL-MR3420 keep saying "Fail to Connect the mail server.". I have tried nearly everything, including disabling authentication and giving the IP-address of the smtp server directly instead of the URL.

View 1 Replies View Related

Copyrights 2005-15, All rights reserved