djdylan78 ha scritto:Per principio il pix è completamente blindato, sicuramente sono bloccati gli icmp reply dalla dmz verso la inside e quindi se provi a pingare viene impedita la risposta dal server in dmz tranne che sia esplicitamente permesso da qualche acl
prova a tirare su un debug ip packet per verificare se arrivano pacchetti dalla inside destinati al server mail
altra cosa che puoi provare un telnet sulla porta smtp del server per vedere effettivamente se funziona la connettività da inside a dmz
cmq se posti la config è un po' piu' semplice provare a rispondere...
ecco la conf ... ( con il telnet non funge)
hostname pixfirewall
domain-name xxxxx.it
enable password xxxxxxxxxxxxx encrypted
names
!
interface Ethernet0
speed 100
duplex full
nameif outside
security-level 0
ip address xxx.xxx.xxx.xxx 255.255.255.0
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 10.1.1.1 255.255.0.0
!
interface Ethernet2
nameif dmz
security-level 50
ip address 10.2.2.1 255.255.255.0
!
passwd xxxxxxxxxx encrypted
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
access-list inside_access_in extended permit ip 10.1.0.0 255.255.0.0 any
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit ip any 151.13.0.0 255.255.0.0
access-list outside_access_in extended permit ip any any
access-list dmz_access_in extended permit ip any any
access-list dmz_access_out extended permit ip any any
access-list inside_access_out extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging buffer-size 102480
logging console debugging
logging monitor debugging
logging buffered debugging
logging trap informational
logging history debugging
logging asdm debugging
logging mail debugging
logging facility 22
logging host outside 10.1.100.77
logging ftp-server 10.1.100.19 /log/pix515e/ pix ****
logging permit-hostdown
logging message 103001 level emergencies
logging message 101002 level notifications
logging message 101003 level warnings
logging message 101001 level informational
logging message 101004 level errors
logging message 101005 level critical
logging message 100000 level debugging
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip audit name attack attack action alarm drop reset
ip audit name info info action alarm
ip audit interface outside info
ip audit interface outside attack
ip audit attack action drop
no failover
monitor-interface outside
monitor-interface inside
monitor-interface dmz
icmp permit any outside
asdm image flash:/asdm504.bin
asdm history enable
arp timeout 14400
nat-control
global (outside) 555 pool di indirizzi pubblici
global (outside) 9999 singolo ip pubblico per nat di gruppo
global (inside) 100 singolo ip pubblico statico per host interno
nat (inside) 555 10.1.0.0 255.255.0.0
static (inside,outside) xxx.xx.20.30 10.1.100.180 netmask 255.255.255.255
static (dmz,outside) xxx.xx.20.42 10.2.2.2 netmask 255.255.255.255
static (dmz,outside) xxx.xx.20.43 10.2.2.3 netmask 255.255.255.255 dns
static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.0.0
static (inside,outside) xxx.xx.20.200 10.1.3.77 netmask 255.255.255.255
static (dmz,inside) xxx.xx.20.43 10.2.2.3 netmask 255.255.255.255
static (dmz,inside) xxx.xx.20.42 10.2.2.2 netmask 255.255.255.255
static (dmz,inside) xxx.xx.20.44 10.2.2.4 netmask 255.255.255.255
static (dmz,outside) xxx.xx.20.44 10.2.2.4 netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group dmz_access_in in interface dmz
access-group dmz_access_out out interface dmz
route outside 0.0.0.0 0.0.0.0 xxx.xx.20.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 87.12.182.1 255.255.255.255 outside
http 10.1.0.0 255.255.0.0 inside
snmp-server host inside 10.1.100.110 poll community Canopy version 2c
snmp-server host outside xxx.xx.20.40 poll community private version 2c
snmp-server location xxxx
snmp-server contact xxxxx
snmp-server community private
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet xxx.xx.20.0 255.255.255.0 outside
telnet 10.1.0.0 255.255.0.0 inside
telnet timeout 5
ssh 87.12.182.1 255.255.255.255 outside
ssh 10.1.100.110 255.255.255.255 inside
ssh timeout 5
console timeout 0
dhcpd address 10.1.1.2-10.1.2.1 inside
dhcpd dns 212.216.172.162 212.216.112.112
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
!
class-map global-class
match default-inspection-traffic
!
!
policy-map global-policy
class global-class
inspect ctiqbe
inspect rsh
inspect esmtp
inspect h323 ras
inspect ftp
inspect http
inspect sip
inspect icmp error
inspect xdmcp
inspect h323 h225
inspect netbios
inspect icmp
inspect ils
inspect rtsp
inspect skinny
inspect tftp
inspect sqlnet
inspect pptp
inspect dns
inspect mgcp
inspect sunrpc
inspect snmp
!
service-policy global-policy global
ntp server 193.204.114.105 source outside prefer
Cryptochecksum:xxxxxxxxxxxxxx
: end
((