How do I create an access list to control SMTP traffic?

[phaqgm]

I want to create an access list(s) that will only allow specific IP's through the firewall for SMTP traffic. So instead of the normal config:

access-list outin permit tcp any host <<IP>> eq smptp

I want to be able to allow specific IP addresses instead of ANY.

 

[phaqgm]

This is for a Cisco Pix 515. Thanks.

 

[fmonteiro]

access-list outin permit tcp host <source ip address> host <target ip address> eq smtp

 

[phaqgm]

I have tried that, but it is saying it's an invalid command. I figured that was the correct syntax, but it will not work.

 

[fmonteiro]

It works on my firewall. See:
pixfirewall(config)# sh ver

Cisco PIX Firewall Version 6.2(1)

Compiled on Wed 17-Apr-02 21:18 by morlee

pixfirewall up 2 days 3 hours

Hardware: SE440BX2, 128 MB RAM, CPU Pentium II 350 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash AT29C257 @ 0xfffd8000, 32KB

0: ethernet0: address is 0002.b322.d504, irq 11
1: ethernet1: address is 0002.b322.cea2, irq 10
Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES: Disabled
Maximum Interfaces: 6
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited

Serial Number: 18051260 (0x11370bc)
Running Activation Key: 0x71a1f483 0xc43565a8 0x0e2e6a7a 0x9355496e
Configuration last modified by enable_15 at 06:36:26.649 UTC Thu Jul 17 2003
pixfirewall(config)#

pixfirewall(config)# sh access-list
access-list outin; 1 elements
access-list outin permit tcp host 10.1.1.1 host 20.1.1.1 eq smtp (hitcnt=0)
pixfirewall(config)#

Which version are you running?

 

[phaqgm]

Thank you, fmonteiro!

Your post helped me out. I realized after looking at your config why I couldn't get it to take my specified IP addresses.

When I was trying to configure originally I was typing:

access-list outin permit tcp x.x.x.x host x.x.x.x eq smtp

instead of:

access-list outin permit tcp host x.x.x.x host x.x.x.x eq smtp

Sometimes all it takes is an extra set of eyes. Thanks for being my extra set of eyes!

Tim

 

[phaqgm]

Thank you, fmonteiro!

Your post helped me out. I realized after looking at your config why I couldn't get it to take my specified IP addresses.

When I was trying to configure originally I was typing:

access-list outin permit tcp x.x.x.x host x.x.x.x eq smtp

instead of:

access-list outin permit tcp host x.x.x.x host x.x.x.x eq smtp

Sometimes all it takes is an extra set of eyes. Thanks for being my extra set of eyes!

Tim