Cisco ASA Port-Forward

PIX/ASA 7.x and above: Mail (SMTP) Server Access on the DMZ Configuration Example

!— This access list allows hosts to access !— IP address 192.168.200.227 for the !— Simple Mail Transfer Protocol (SMTP) port.

access-list outside_int extended permit tcp any host 192.168.200.227 eq smtp

!— Allows outgoing SMTP connections. !— This access list allows host IP 172.16.31.10 !— sourcing the SMTP port to access any host.

access-list dmz_int extended permit tcp host 172.16.31.10 any eq smtp

!— This network static does not use address translation. !— Inside hosts appear on the DMZ with their own addresses.

static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

!— This network static uses address translation. !— Hosts accessing the mail server from the outside !— use the 192.168.200.227 address.

static (dmz,outside) 192.168.200.227 172.16.31.10 netmask 255.255.255.255

access-group outside_int in interface outside
access-group dmz_int in interface dmz

!— The inspect esmtp command (included in the map) allows !— SMTP/ESMTP to inspect the application.

policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp