Re: SMTP and tcp ports

From: News Reader <user@xxxxxxxxxxx>
Date: Wed, 30 Apr 2008 12:04:37 -0400

Bob Simon wrote:

I have an access list applied inbound on the outside interface of a
2600 connected to the edge router. I found that I needed smtp ACEs
for both the source port and for the destination port to our exchange
server.
50 permit tcp any eq smtp host 192.168.0.20 (99012 matches)

Matching SMTP exchanges with external SMTP servers (source port 25).
This ACE would not match clients (source port >1023).

60 permit tcp any host 192.168.0.20 eq smtp log (880 matches)

This ACE currently matches clients (destination port 25). Servers were matched on the previous ACE.

If you eliminate ACE # 50, clients and servers would match ACE # 60.

Why is this? I thought inbound traffic to the server would be on
random destination ports allocated by PAT on the edge router; no?

Best Regards,
News Reader
.

Follow-Ups:
- Re: SMTP and tcp ports
  - From: Bob Simon

References:
- SMTP and tcp ports
  - From: Bob Simon

Prev by Date: Policy Based Routing on Cisco L3 Switch 3550 with IOS 12.1(22)
Next by Date: Re: How to use CLI to change pre-shared-key on ASA: Forgot Password
Previous by thread: SMTP and tcp ports
Next by thread: Re: SMTP and tcp ports
Index(es):
- Date
- Thread

Relevant Pages

Re: SMTP and tcp ports
... This ACE would not match clients (source port>1023). ... This ACE currently matches clients (destination port 25). ... A Cisco switch initiates an NTP connection to an NTP server on the router: ...
(comp.dcom.sys.cisco)
Re: SMTP and tcp ports
... random destination ports allocated by PAT on the edge router; ... Outbound SMTP connections from your server to an Internet-residing server would be from source port 25 with returning traffic coming to destination port 25. ... An internal client initiates a connection with source port 1200 to a server on the web. ...
(comp.dcom.sys.cisco)
Re: SMTP and tcp ports
... for both the source port and for the destination port to our exchange ... random destination ports allocated by PAT on the edge router; ...
(comp.dcom.sys.cisco)
Re: SMTP and tcp ports
... for both the source port and for the destination port to our exchange ... This ACE would not match clients (source port>1023). ... This ACE currently matches clients (destination port 25). ...
(comp.dcom.sys.cisco)
Re: FTP server
... With the original ftpd, here is what i get by analysing: ... Source port: 1025 Destination port: 65000 ... Connection not closed abruptly ...
(microsoft.public.windowsce.embedded)