Introduction
This sample configuration demonstrates how to set up the PIX Firewall for access to a mail server located on the Demilitarized Zone (DMZ) network.
Note: Refer to Cisco Documentation for Cisco Secure PIX Firewall for more information on how to set up Microsoft Exchange. Choose your software version, then go to the configuration guide and read the chapter on configuring Microsoft Exchange.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
The information in this document is based on these software and hardware versions:
-
PIX Firewall 535
-
PIX Firewall software release 7.1(1)
-
Cisco 2600 router
-
Cisco IOS® Software Release 12.3.14T
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to the Cisco Technical Tips Conventions for more information on document conventions.
Configure
In this section, you are presented with the information to configure the features described in this document.
Note: Use the Command Lookup Tool ( registered customers only) to obtain more information on the commands used in this section.
Network Diagram
This document uses this network setup:
Note: The IP addressing schemes used in this configuration are not legally routable on the Internet. They are RFC 1918 addresses which have been used in a lab environment.
PIX Configuration
This document uses this configuration:
PIX Configuration |
---|
PIX Version 7.1(1) |
ESMTP TLS Configuration
Note: If you use Transport Layer Security (TLS) encryption for e-mail communication then the ESMTP inspection feature (enabled by default) in the PIX drops the packets. In order to allow the e-mails with TLS enabled, disable the ESMTP inspection feature as this output shows.
pix(config)#policy-map global_policy
pix(config-pmap)#class inspection_default
pix(config-pmap-c)#no inspect esmtp
pix(config-pmap-c)#exit
pix(config-pmap)#exit
Verify
There is currently no verification procedure available for this configuration.
Troubleshoot
This section provides information you can use to troubleshoot your configuration.
Troubleshooting Commands
The Output Interpreter Tool ( registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.
Note: Refer to Important Information on Debug Commands before you use debug commands.
-
debug icmp trace—Shows whether Internet Control Message Protocol (ICMP) requests from the hosts reach the PIX. You need to add the access-list command to permit ICMP in your configuration in order to run this debug.
Note: In order to use this debug, make sure you allow ICMP in the access-list outside_int as this output shows:
access-list outside_int extended permit tcp any host 192.168.200.227 eq smtp
access-list outside_int extended permit icmp any any -
logging buffer debugging—Shows connections that are established and denied to hosts that go through the PIX. The information is stored in the PIX log buffer, and the output can be seen with the show log command.
Refer to Setting Up the PIX Syslog for more information on how to set up logging.