How to Block all outbound SMTP except Exchange Server

How to Block all outbound SMTP except Exchange Server
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
How to Block all outbound SMTP except Exchange Server Ross 07-20-2007
Posted by Ross on July 20, 2007, 5:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi there,
I have a Cisco PIX 515e version 7.2, and I have an Exchange email server
inside the firewall, which are all working well.
Right now, I'm trying to block all outgoing SMTP traffic (over port 25),
except from my company's Exchange server.
Any idea about how to do this is appreciated.
Ross



Pure Networks
Posted by on July 20, 2007, 10:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Hi there,
> I have a Cisco PIX 515e version 7.2, and I have an Exchange email server
> inside the firewall, which are all working well.
> Right now, I'm trying to block all outgoing SMTP traffic (over port 25),
> except from my company's Exchange server.
> Any idea about how to do this is appreciated.
> Ross

access-list SMTP-CONTROL permit tcp host 10.1.1.1 any eq smtp ! Where
10.1.1.1 is the IP address of Exchange
access-list SMTP-CONTROL deny tcp any any eq smtp
access-list SMTP-CONTROL permit ip any any ! implicit deny any any
!
access-group SMTP-CONTROL in interface inside
!

Since the access-list gets executed in order, line one runs first and
wont make it to line two unless it is a TCP connection on port 25 with
a different IP address. Remember if anyone trys to send any mail
except the exchange server it will be blocked.


Posted by GNY on July 21, 2007, 11:43 am
If you were  Registered and logged in, you could reply and use other advanced thread options
On Jul 20, 10:31 pm, gc...@routergod.com wrote:
>
> > Hi there,
> > I have a Cisco PIX 515e version 7.2, and I have an Exchange email server
> > inside the firewall, which are all working well.
> > Right now, I'm trying to block all outgoing SMTP traffic (over port 25),
> > except from my company's Exchange server.
> > Any idea about how to do this is appreciated.
> > Ross
>
> access-list SMTP-CONTROL permit tcp host 10.1.1.1 any eq smtp ! Where
> 10.1.1.1 is the IP address of Exchange
> access-list SMTP-CONTROL deny tcp any any eq smtp
> access-list SMTP-CONTROL permit ip any any ! implicit deny any any
> !
> access-group SMTP-CONTROL in interface inside
> !
>
> Since the access-list gets executed in order, line one runs first and
> wont make it to line two unless it is a TCP connection on port 25 with
> a different IP address. Remember if anyone trys to send any mail
> except the exchange server it will be blocked.

Sorry to thread jack .. But on an ASA if I was trying to do something
similar would I have to assign this access-list to an interface? Or is
this only for IOS routers where you have to assign the ACL to an
interface?

Thanks and sorry again ..

GNY


Posted by Chris on July 21, 2007, 2:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Sat, 21 Jul 2007 15:43:39 -0000, GNY wrote:

> On Jul 20, 10:31 pm, gc...@routergod.com wrote:
>>
>>> Hi there,
>>> I have a Cisco PIX 515e version 7.2, and I have an Exchange email server
>>> inside the firewall, which are all working well.
>>> Right now, I'm trying to block all outgoing SMTP traffic (over port 25),
>>> except from my company's Exchange server.
>>> Any idea about how to do this is appreciated.
>>> Ross
>>
>> access-list SMTP-CONTROL permit tcp host 10.1.1.1 any eq smtp ! Where
>> 10.1.1.1 is the IP address of Exchange
>> access-list SMTP-CONTROL deny tcp any any eq smtp
>> access-list SMTP-CONTROL permit ip any any ! implicit deny any any
>> !
>> access-group SMTP-CONTROL in interface inside
>> !
>>
>> Since the access-list gets executed in order, line one runs first and
>> wont make it to line two unless it is a TCP connection on port 25 with
>> a different IP address. Remember if anyone trys to send any mail
>> except the exchange server it will be blocked.
>
> Sorry to thread jack .. But on an ASA if I was trying to do something
> similar would I have to assign this access-list to an interface? Or is
> this only for IOS routers where you have to assign the ACL to an
> interface?
>
> Thanks and sorry again ..
>
> GNY


The example above is for a Pix version 7.x, which is essentially the same
as an ASA. So yes, you have to apply the access-list to an interface.

Chris.

Posted by Ross on July 23, 2007, 5:47 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks to everyone!
It works well with blocking SMTP.
But it stoped the blocking of bitTorrent. I had a setup for blocking
bitTorrent, but once I enabled the SMTP blocking, the bitTorrent traffic
becomes available now.
Why?

BTW, here was my setup for blocking BT:
access-list block_BT deny tcp any any range 6881 6999
access-list block_BT permit ip any any
access-group block_BT in interface inside

Any idea would be appreciated again,
Ross

>> Hi there,
>> I have a Cisco PIX 515e version 7.2, and I have an Exchange email server
>> inside the firewall, which are all working well.
>> Right now, I'm trying to block all outgoing SMTP traffic (over port 25),
>> except from my company's Exchange server.
>> Any idea about how to do this is appreciated.
>> Ross
>
> access-list SMTP-CONTROL permit tcp host 10.1.1.1 any eq smtp ! Where
> 10.1.1.1 is the IP address of Exchange
> access-list SMTP-CONTROL deny tcp any any eq smtp
> access-list SMTP-CONTROL permit ip any any ! implicit deny any any
> !
> access-group SMTP-CONTROL in interface inside
> !
>
> Since the access-list gets executed in order, line one runs first and
> wont make it to line two unless it is a TCP connection on port 25 with
> a different IP address. Remember if anyone trys to send any mail
> except the exchange server it will be blocked.
>



Similar ThreadsPosted
Redirect Outbound SMTP Traffic to Specific Server - 837 and 2621 July 21, 2004, 5:15 pm
Block Outbound HTTP except from Proxy November 21, 2006, 1:46 pm
block smtp traffic December 28, 2004, 9:40 pm
Access List to Block Outgoing SMTP on PIX December 1, 2005, 11:15 am
PIX problems with exchange server April 20, 2005, 6:12 am
Newbie Exchange Server Config February 24, 2005, 10:36 am
Spoke and Hub having problems with exchange server October 28, 2005, 9:05 am
Problem with Exchange server behind PIX firewall April 7, 2006, 10:05 am
Access to a intern WWW/SMTP Server December 4, 2007, 7:57 am
PIX 501-Closing SMTP to all inside addresses except Server June 20, 2005, 2:13 pm

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map