Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Web Server ( in my DMZ that needs to communicate with the our Exchange Server ( internally via SMTP. I used access-list acl-dmz permit tcp host host eq smtp, but it did not work.

Is it because of the deny ip line in acl-outbound or the nat ACL? If not, can anyone see what might be causing this? My config is below:

access-group acl-inbound in interface outside
access-group acl-outbound in interface inside
access-group acl-dmz in interface dmz1

PIX_6.3(5)_515# sh access-list acl-outbound | in deny
access-list acl-outbound line 86 deny ip (hitcnt=1209)
access-list acl-outbound line 90 deny ip any any (hitcnt=1014022)
PIX_6.3(5)_515# sh access-list acl-dmz
access-list acl-dmz; 2 elements
access-list acl-dmz line 1 permit udp host host eq domain (hitcnt=5625)
access-list acl-dmz line 2 permit ip host any (hitcnt=1089)
PIX_6.3(5)_515# sh nat
nat (inside) 0 access-list nonat
nat (inside) 1 0 0
nat (inside) 1 0 0
nat (inside) 1 0 0
nat (inside) 2 0 0
PIX_6.3(5)_515# sh run | in static
static (inside,outside) tcp smtp smtp netmask 0 0
static (inside,outside) netmask 0 0
static (inside,outside) netmask 0 0
static (dmz1,outside) netmask 0 0
static (dmz1,inside) netmask 0 0
static (inside,dmz1) netmask 0 0
PIX_6.3(5)_515# sh run | in global
global (outside) 1
global (outside) 2 interface
share|improve this question
-1, voted to close. Please make this legible, and make it bear some resemblance to a question. Or, if it's really "very urgent," jump on the phone and hire an expert as a consultant to fix it for you. – HopelessN00b Aug 1 '12 at 17:11
Please avoid things in your title of question like "...VERY URGENT!!". I've edited it out of this question, but in the future don't do that. If your problem is really that urgent, you should be hiring a consultant to assist you, not posting on a free community. – MDMarra Aug 1 '12 at 17:15
@HopelessN00b It really wasn't that bad when you go into edit view. He just didn't wrap the output in code markdown and English clearly isn't his first language, that's all. Maybe next time, edit the question to be better instead of writing why it should be closed :) – MDMarra Aug 1 '12 at 17:18
@MDMarra ..Thnks will follow – chinni Aug 1 '12 at 17:18
Ah, I got ya. A lot of times if you click "edit" on questions like this, you'll see it's actually formatted nicely in the text box, but new users typically don't have a grasp on how to use markdown to make it look nice when presented as a question :) – MDMarra Aug 1 '12 at 17:32

I think the DENY is your problem.


access-list line 3 acl-dmz permit tcp host host eq smtp
access-list line 88 acl-outbound permit tcp host host
share|improve this answer
Does the static (dmz1,inside) netmask 0 0 ... have any role to play.I want to use the "" static (inside,dmz1) netmask 0 0 "" ..where my inside network is 10.77 subnet. ...please help me understand this. Thanks in advance. – chinni Aug 1 '12 at 18:12
Inside should talk to DMZ without needing that static, IIRC. (I no longer have a PIX). IF you want to test with a bit less disruption you could do a smaller sized static static (inside,dmz1) netmask 0 0 – Mark Aug 1 '12 at 18:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.