Unable to open SMTP session through ASA 5512-X

Question

Hi All,
Just doing some basic testing before we replace our ancient PIX 515E with a new 5512. I have a mini lab set up following the diagram below, although I am unable to telnet through to the mail server's netcat listener on port 25 TCP. I can ping all the way outbound from 192.168.101.1 to 10.0.0.2, and the 10.0.0.2 machine shows it is translated properly to 200.225.117.1.
NAT and access rules are as follows:
object network mail host 192.168.101.1 description Mail relayaccess-list inbound extended permit ip any host 200.225.117.1ASA# sh routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static routeGateway of last resort is 72.38.1.2 to network 0.0.0.0
C    192.168.100.0 255.255.255.0 is directly connected, inside
C    72.38.1.0 255.255.255.0 is directly connected, outside
C    192.168.101.0 255.255.255.0 is directly connected, dmz1
S*   0.0.0.0 0.0.0.0 [1/0] via 72.38.1.2, outside
Any ideas? I am also unable to ping the 200.225.117.1 machine with access list permitting IP.
EDIT: Somehow the new global access rule is involved. When adding a permit any any in there I can get to the mail server no problem. When I remove it but leave in my permit ip any any on the outside interface, I am denied?!?!

Answer 1

You can actually refer to the object in the access-list instead of the actual ip address.
There is also a lot of more flexible NAT that you can configure, ie: both source and destination IP and ports being translation, etc.
Here is the major changes which take place from version 8.3:
http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html
1) NAT
2) Access-list
3) Licensing if you have failover pair, doesn't need to be the same anymore.