Email Port Open for ASA5505

Question

Hi all ;
Just posted a question that when I want to let email to come through the ASA5505 from outside to DMZ and Inside network, are the below command lines correct and good enough?
access-list  outside_DMZ extended permit tcp outside-network-ip dmz-network-ip eq imap4
access-list outside_DMZ extended permit tcp outside-network-ip dmz-network-ip eq pop3
access-list outside_DMZ extended permit tcp outside-network-ip dmz-network-ip eq smtp
access-list outside_inside extended permit tcp outside-network-ip inside-network-ip eq imap4
access-list outside_inside extended permit tcp outside-network-ip inside-network-ip eq pop3
access-list outside_inside extended permit tcp outside-network-ip inside-network-ip eq smtp
access-group outside_DMZ in interface outside
access-group outside _inside interface outside
Are there any other TCP ports want to be allowed and other command lines need to be added?
Thanks!
Regards,
tangsuan

Answer 1

Hi Jcarvaja :
Thanks for your reply!
1. For inside to outside, I have used a dynamic nat as below :
nat (inside) 20 192.168.100.0 255.255.255.0
global (outside) 20 192.168.50.171-192.168.50.180
As such, it should be not necessary for static one to one from inside to outside, right?
2. For dmz to outside, I use the static nat and so each individual mapped IP is need to create. For example :
static (dmz,outside) 192.168.20.x 192.168.50.x netmask 255.255.255.255
whereby 192.168.20.x is host at outside network and 192.168.50.x is at dmz network. This will be ok, right?
3. As for the ACL, I can group all the hosts (servers or stations) at dmz and inside and applied one ALC as below :
access-list Email_in extended permit tcp object-group Outside_Network object-group hosts_dmz_inside eq smtp
access-list Email_in extended permit tcp object-group Outside_Network object-group hosts_dmz_inside eq pop3
access-list Email_in extended permit tcp object-group Outside_Network object-group hosts_dmz_inside eq imap4
Let me know is it any problem, thanks!
regards,
tangsuan