I have an Cisco asa 5520 8.2(1) firewall that I can't get to give me access to my mail server in DMZ. Here's my configuration:
object-group network WEB_SERVERS network-object host 172.16.1.30 object-group network MAIL_SERVERS network-object host 172.16.1.40 object-group service WEB_SERVICES tcp port-object eq www port-object eq https object-group service MAIL_SERVICES tcp port-object eq smtp port-object eq imap4 port-object eq pop3 port-object eq 995 port-object eq 993 port-object eq 465
access-list OUTSIDE_TO_DMZ extended permit ip any any access-list OUTSIDE_TO_DMZ extended permit tcp any object-group WEB_SERVERS object-group WEB_SERVICES access-list OUTSIDE_TO_DMZ extended permit tcp any object-group MAIL_SERVERS object-group MAIL_SERVICES access-list OUTSIDE_TO_DMZ extended deny ip any any log
access-group OUTSIDE_TO_DMZ in interface outside
If I do the packet-tracer command: "packet-tracer input outside tcp 220.127.116.11 143 109.xxx.yyy.131 143", I get the following result:
Phase: 1 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found no matching flow, creating a new flow Phase: 2 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 109.xxx.yyy.131 255.255.255.255 identity Phase: 3 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information:
I have full access to my web server in DMZ so I can't quite see why access to my mail server fails.
Thanks in advance
Edit: Here are my NAT statements:
nat (dmz) 101 172.16.1.0 255.255.255.0 nat (dmz) 101 0.0.0.0 0.0.0.0 nat (inside) 101 192.168.1.0 255.255.255.0 nat (inside) 101 0.0.0.0 0.0.0.0 nat (data) 101 192.168.128.0 255.255.255.0 nat (data) 101 0.0.0.0 0.0.0.0
EDIT: This is very strange. The packet-tracer command runs smoothly on the SMTP port, but fails on all other ports (imap4, pop3, 995, 993 and 465).
Edit: I think everything has had a happy ending. Cisco cannot help as support on asa 5520 expired last September. But I have found a Danish dealer who has been so helpful in sending me an image on version 9(17). However, I can only upgrade late this evening Danish time, as I have customers who use my web systems.