I have an Cisco asa 5520 8.2(1) firewall that I can't get to give me access to my mail server in DMZ. Here's my configuration:

Object groups

object-group network WEB_SERVERS
 network-object host

object-group network MAIL_SERVERS
 network-object host

object-group service WEB_SERVICES tcp
 port-object eq www
 port-object eq https

object-group service MAIL_SERVICES tcp
 port-object eq smtp
 port-object eq imap4
 port-object eq pop3
 port-object eq 995
 port-object eq 993
 port-object eq 465


access-list OUTSIDE_TO_DMZ extended permit ip any any
access-list OUTSIDE_TO_DMZ extended permit tcp any object-group WEB_SERVERS object-group WEB_SERVICES
access-list OUTSIDE_TO_DMZ extended permit tcp any object-group MAIL_SERVERS object-group MAIL_SERVICES
access-list OUTSIDE_TO_DMZ extended deny ip any any log


access-group OUTSIDE_TO_DMZ in interface outside

If I do the packet-tracer command: "packet-tracer input outside tcp 143 109.xxx.yyy.131 143", I get the following result:

Phase: 1
Result: ALLOW
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Subtype: input
Result: ALLOW
Additional Information:
in   109.xxx.yyy.131 identity

Phase: 3
Result: DROP
Implicit Rule
Additional Information:

I have full access to my web server in DMZ so I can't quite see why access to my mail server fails.

Thanks in advance

Edit: Here are my NAT statements:

nat (dmz) 101
nat (dmz) 101
nat (inside) 101
nat (inside) 101
nat (data) 101
nat (data) 101

EDIT: This is very strange. The packet-tracer command runs smoothly on the SMTP port, but fails on all other ports (imap4, pop3, 995, 993 and 465).

Edit: I think everything has had a happy ending. Cisco cannot help as support on asa 5520 expired last September. But I have found a Danish dealer who has been so helpful in sending me an image on version 9(17). However, I can only upgrade late this evening Danish time, as I have customers who use my web systems.

closed as too broad by Ron Maupin Feb 12 at 16:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need to show us your NAT statements to make sure that those are correct. – Jesse P. Jan 27 at 21:51
  • @jesse-p You're right, my log shows nothing. Here is my nat statement: nat (dmz) 101 nat (dmz) 101 nat (inside) 101 nat (inside) 101 nat (data) 101 nat (data) 101 – Søren Sjøstrøm Jan 27 at 21:57
  • If you remove that "permit IP any any", does your deny line start logging traffic? I didn't catch that you were on 8.2 code. Have you considered upgrading to 8.3 or newer? – Jesse P. Jan 27 at 22:12
  • Still no logging after I removed "permit IP any any". My log says "Syslog logging: disabled". How do I enable it? Unfortunately, I cannot upgrade my software. Since I am on a low budget, it is a firewall that I have bought used. – Søren Sjøstrøm Jan 27 at 22:20
  • 3
    "I do not know where to get the software. Have asked Cisco if they want to help, but they won't." You must get the code from Cisco, and you need a SmartNet contract, then you get code upgrades and support for the duration of the contract. Also, you do not need syslog logging to see the log, which is locally stored. – Ron Maupin Jan 28 at 0:23

Your nat statements are wrong for what you are trying to accomplish with that version. You need a STATIC nat. Use this:

static (dmz,outside) 109.x.x.x netmask

Also, depending on your mail system - you may need to disable SMTP inspection. You could do that globally or specifically with MFP.

Not the answer you're looking for? Browse other questions tagged or ask your own question.