Security

Ask something
Discussion Locked

ASA Firewall/DMZ issue

0 helpful
7 replies

by computer geek 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Our network has a DMZ outside of an ASA Firewall. Our mail server sits on the DMZ but we have another mail server internally that was just added. The problem is the external DMZ email server cannot communicate to the internal email server. Anyone know how to configure the ASA to allow mail going from the DMZ email server to the internal server?

7 replies

by computer geek

The internal mail server is able to receive mail for all other sources (external as well as from others using the same server). It is only from the mail server outside the firewall in our DMZ that is not reaching the internal mail server.

by bfilmfan

Is there a connector to the external email server?

And what mail program are you using?

by computer geek

The internal mail server is Exchange (2000), the external (DMZ) server is Postfix.

I'm not sure what you mean by connector. It only goes to the DMZ. There's no route into the network itself.

by mshavrov

Since you didn't put the Firewall Vendor, I assume it's Cisco.

Standard scenarion for the firewall installation includes the "outside" interface with a security level 1, "inside" interface with a security level 100, and "dmz" with a security level between 1 and 100. You automatically permit any traffic from the higher security level to lower (with appropriate NAT translations configured).

To allow traffic from the lower security level to higher security level you have to create a rules for specific traffic. So, if your DMZ-Mail server have to communicate with the LAN-MAIL server, you have to either create a Static NAT Translation (or configure no-NAT), and add rules to permit required traffic.

Good luck,

Mike
----
CCSP, CCNP, CCDP, Security+, MCSE W2K, MCSE+I, etc.
http://www.ciscoheadsetadapter.com

by computer geek

Actually we finally found the correct rule to enter. It did involve creating a static route. Thank you for your help.

This discussion is closed to new replies.