Ports Required for SMTP access from DMZ

Question

We have a Windows 2000 Adv Server on a DMZ interface of a PIX firewall. We are using native Windows SMTP services as a Front End server for Exchange mail. Our Exchange server has a SmartHost entry that sends outbound mail to the server on the DMZ. Our MX record points to the server on the DMZ for inbound traffic.
We originally allowed DNS resolution and SMTP (Port 25) traffic to the server. We've done this numerous times from the Internal interface of the PIX. Yet, there apparently is at least one other port that needs to be opened up because the mail stays in the Queue of the SMTP server on the DMZ. We got around the problem by opening up all outbound ports from that server.
My question is: "Does anyone know what ports are required for an SMTP server to work on a PIX DMZ?"
Thanks

Answer 1

Should just be TCP/25 and probably DNS (UDP/53). Probably the easiest way to figure out what other port it's using is to look at the active connections from this going through your PIX.
Let's say the IP address of the mail server is 10.1.1.1. Doing:
sho conn | include 10.1.1.1
will give you all the connections. This will tell you where it's connectig to and on what ports. The output will look something like:
FW1(config)# sho conn | incl 10.1.1.1
UDP out 10.2.2.1:17127 in 10.1.1.1:10655 idle 0:01:23 Bytes 1000
UDP out 10.2.2.1:18733 in 10.1.1.1:10477 idle 0:01:38 Bytes 1000
UDP out 10.3.3.2:18429 in 10.1.1.1:10789 idle 0:01:10 Bytes 1000
The numbers after the colons are the port numbers on the connection. Of course yours will show TCP and port 25 (and something else hopefully), but you get the idea.