Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Probably a dumb question, but I am very inexperienced with how to configure our ASA 5510 - using the ASDM tool seems easier that the old IOS CLI, however.

What I want to do is block all SMTP traffic from leaving our internal network through the firewall, EXCEPT from a few specified servers (mail server, web servers). Here is what I've done:

1) Created a network group with the internal IP addresses of the servers that should be sending email (WEB_EMAIL)

Now, here is what I think I need to do.

2) Set up an inside access rule as follows: Source: WEB_EMAIL Destination:any Service: tcp: smtp Action: permit

3) Set up an inside access rule just below that last one as follows: Source: any Destination:any Service: tcp: smtp Action: deny

Have I got it correct? Or should the destination in both of those rules be the outside IP address? Are there any nasty side effects that I should be aware of?

Thanks

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You've got it right; the destination on SMTP traffic is going to be the server that it's attempting to send to, which could be anywhere.

Building the rule on the inside interface was the correct thing to do, as it's controlling traffic that's coming into the inside interface from your internal network.

Should be good to go!

share|improve this answer
    
So, just to confirm - if on the inside rules, I have as (say) sequence number 8 the "allow" rule for my mail servers, then as sequence number 9 the "deny" rule for any / any, that will achieve what I want? And the IP addresses specified in the "destination" for inside rules are IP addresses that the ASA controls on its outside interface? –  Ken Ray Apr 1 '11 at 14:59
    
@Ken Yes, the email servers will be allowed to send mail, and all other internal systems will be denied. The IP address specified can really be on any interface, other than "inside"; it's really just checking the connection that's trying to establish, without checking which interface it's going to. That said, it'll obviously be on the outside interface in this case; but the destination address will be the recipient's email server. So, though the short-term destination of the traffic is the firewall, the eventual destination is the remote server - think of it in terms of the final destination. –  Shane Madden Apr 1 '11 at 15:15
1  
Side note: Remember that the ASA processes rules from a top/down order for each interface in ASDM. –  GregD Apr 1 '11 at 16:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.