I tried using the CLI to enter the syntax exactly as you show but it gives me an error indicating invalid host. This seems backward from your example as it is Source IP - ports to be opened - destination IP. For example, I enter the proper instructions to allow any source ip to access 67.xxx.xxx.160 and use tcp/25 (for smpt) the output generated by the ASDM is as follows:Īccess-list outside_access_in extended permit tcp any eq smtp host 67.xxx.xxx.160 When I used the ASDM menus it seems that the syntax is going in backwards. Still, I see what you are saying about the order in the syntax and I tried to implement your example. One thing I should point out is that the group 'Mail' you saw in the config file is a TCP Service group to apply the permission for SMTP, POP3 and IMAP4 as a group of permitted ports and not a network-object. I'm assuming I'm missing a command or something but would appreciate any suggestions or advice on how to proceed.

To make matters worse my 506E power supply died when I tried to fall back to using it so now I'm really stuck. But, in reality nothing is getting through that originates from the outside as I'm watching the syslog messages and the ASA is clearly denying traffic that should be permitted. Further, when I run the ASDM Packet Tracer to simulate inbound traffic coming into my services from the outside interface it reports that everything is working correctly and indicates the message should be successfully delivered to the inside host. I've followed the getting started guide instructions, and even configuration guides on Cisco's website but I'm still having trouble. I have internet access for my internal network working fine but no matter what I try I can't get my DNS servers, web servers or email servers to be visible to the outside world. I'm not a firewall expert by a long shot and the commands in the 5505 are just different enough to be confusing to me. Since it had finally reached end of life I bought an ASA 5505 with the security bundle. I run a very small web, email and dns hosting businessmen and had been running a PIX 506E for several years with no problems.

Cisco asa 5505 end of life