Asa5512, ver. 8.6(1)2, SMTP over NAT problem

Question

hi guys,
i have a weird issue while trying to organize smtp-server behind my asa 5512.
the most interesting thing is that all other services like ssh, http, https, etc works just fine...except smtp....and yes, i've disabled inspect esmtp feature.
object network obj-10.100.22.19
host 10.100.22.19
object network PAT
subnet 10.100.22.16 255.255.255.248
access-list inet-in extended permit tcp any host 10.100.22.19 eq smtp
access-list inet-in extended permit tcp host X.X.X.X host 10.100.22.19 eq ssh
access-list inet-in extended permit tcp host X.X.X.X host 10.100.22.19 eq imap4
access-list inet-in extended permit tcp host X.X.X.X host 10.100.22.19 eq 993
access-list inet-in extended permit tcp object-group inet-grp1 host 10.100.22.19 eq www
access-list inet-in extended permit tcp object-group inet-grp1 host 10.100.22.19 eq https
object network obj-10.100.22.19
nat (serv2,inet) static Y.Y.Y.Y
object network PAT
nat (serv2,inet) dynamic interface
access-group inet-in in interface inet
what i see in logs:
%ASA-6-302013: Built inbound TCP connection 1733 for inet:X.X.X.X/47056 (X.X.X.X/47056) to serv2:10.100.22.19/25 (Y.Y.Y.Y/25)
%ASA-6-302014: Teardown TCP connection 1733 for inet:X.X.X.X/47056 to serv2:10.100.22.19/25 duration 0:00:30 bytes 0 SYN Timeout
%ASA-6-106015: Deny TCP (no connection) from 10.100.22.19/25 to X.X.X.X/47056 flags SYN ACK  on interface serv2
so it looks like smtp-client doesn't receive TCP ACK while building the session and in 30 sec issues SYN Timout message...
and i am sure, that everything is OK with sendmail, because tcp/25 is opened and working from another dmz of this ASA, the only difference is that dmz connected without NAT...
any ideas?
thanx in advance.

Answer 1

hi,
i've tried to capture via tcpdump on smtp-client and server interfaces and have seen on client side that SYN ACK never comes and on the server side that it does issue this SYN ACK. so it's been dropped somewhere on the way...
server connected directly into ASA interface and client just in few hops on internet.
here's configuration:
ASA Version 8.6(1)2
hostname ________
no names
interface GigabitEthernet0/0
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/1
no nameif
no security-level
no ip address
interface GigabitEthernet0/1.1011
vlan 1011
nameif vlan1011
security-level 75
ip address 10.100.10.11 255.255.255.0
interface GigabitEthernet0/1.1035
vlan 1035
nameif inet
security-level 50
ip address X.X.X.Y 255.255.255.248
interface GigabitEthernet0/2
nameif serv1_mng
security-level 100
ip address 10.100.22.5 255.255.255.252
interface GigabitEthernet0/3
nameif serv2_mng
security-level 100
ip address 10.100.22.1 255.255.255.252
interface GigabitEthernet0/4
nameif serv1
security-level 100
ip address 10.100.22.13 255.255.255.252
interface GigabitEthernet0/5
nameif serv2
security-level 100
ip address 10.100.22.17 255.255.255.248
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
boot system disk0:/asa861-2-smp-k8.bin
ftp mode passive
clock timezone EEST 2
clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
dns domain-lookup inet
dns server-group DefaultDNS
name-server 8.8.8.8
same-security-traffic permit inter-interface
object network obj-10.100.22.19
host 10.100.22.19
object network PAT
subnet 10.100.22.16 255.255.255.248
object-group network vlan1011-grp1
network-object 10.0.0.0 255.255.255.0
network-object 10.100.10.0 255.255.255.0
object-group network vlan1011-grp2
network-object host 10.0.0.238
network-object host 10.0.0.239
object-group network vlan1011-grp3
network-object host 10.100.13.50
network-object host 10.100.14.50
object-group network vlan1011-grp4
network-object host 10.100.10.1
network-object 10.0.0.0 255.255.255.0
object-group service backup-tcp tcp
port-object range 10080 10083
port-object range 10100 10108
object-group service backup-udp udp
port-object range 10080 10083
port-object range 10100 10108
object-group network inet-grp1
network-object host ____________
network-object host ____________
access-list inet-in extended permit icmp any any
access-list inet-in extended permit tcp any host 10.100.22.19 eq smtp
access-list inet-in extended permit tcp host A.A.A.A host 10.100.22.19 eq ssh
access-list inet-in extended permit tcp host A.A.A.A host 10.100.22.19 eq imap4
access-list inet-in extended permit tcp host A.A.A.A host 10.100.22.19 eq 993
access-list inet-in extended permit tcp object-group inet-grp1 host 10.100.22.19 eq www
access-list inet-in extended permit tcp object-group inet-grp1 host 10.100.22.19 eq https
access-list vlan1011-in extended permit icmp any any
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 10.100.22.16 255.255.255.248 eq ssh
access-list vlan1011-in extended permit tcp object-group vlan1011-grp2 10.100.22.16 255.255.255.248 eq 10050
access-list vlan1011-in extended permit tcp object-group vlan1011-grp3 10.100.22.16 255.255.255.248 object-group backup-tcp
access-list vlan1011-in extended permit udp object-group vlan1011-grp3 10.100.22.16 255.255.255.248 object-group backup-udp
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 host 10.100.22.19 eq www
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 host 10.100.22.19 eq https
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 host 10.100.22.19 eq imap4
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 host 10.100.22.19 eq 993
access-list vlan1011-in extended permit tcp object-group vlan1011-grp1 host 10.100.22.19 eq smtp
tcp-map Exp_MSS
pager lines 24
logging enable
logging timestamp
logging buffer-size 100000
logging console warnings
logging monitor informational
logging buffered informational
logging trap errors
logging history informational
logging asdm informational
logging device-id hostname
mtu vlan1011 1500
mtu inet 1500
mtu serv1_mng 1500
mtu serv2_mng 1500
mtu serv1 1500
mtu serv2 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-66114.bin
no asdm history enable
arp timeout 14400
object network obj-10.100.22.19
nat (serv2,inet) static X.X.X.X
object network PAT
nat (serv2,inet) dynamic interface
access-group vlan1011-in in interface vlan1011
access-group inet-in in interface inet
route inet 0.0.0.0 0.0.0.0 X.X.X.Z 1
route vlan1011 10.0.0.0 255.0.0.0 10.100.10.100 1
route vlan1011 10.0.0.0 255.255.255.0 10.100.10.1 1
timeout xlate 9:00:00
timeout conn 48:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca
  quit
telnet 10.100.10.0 255.255.255.0 vlan1011
telnet timeout 30
ssh 10.100.10.0 255.255.255.0 vlan1011
ssh timeout 30
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server __________ prefer
webvpn
class-map Exp_MSS
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class Exp_MSS
  set connection advanced-options Exp_MSS
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect http
  inspect pptp
service-policy global_policy global
prompt hostname context
call-home reporting anonymous