1. Home
  2. Cisco Systems
  3. Cisco 1700 Config not able to processing internal webmail script

Cisco 1700 Config not able to processing internal webmail script

hi guys,

for some reason, an webmail script, when being processed cannot find the email server which is on the same device as the script .. eg, the web host server consists of .. MS Windows 2003 / IIS / 3rd Party email server

now, i am sure you guys will ask if my email server works, and yes, it does. note the following below

1) you can send an email to any hosted domain i have and i WILL receive it. 2) i can send an email to anyone on the internet via my hosted email accounts with no issues

issue, i have a webmail script (url

formatting link
this just sends a test email to snipped-for-privacy@aais.com.au which resides on mail.aais.com.au (and yes, this email account works (as per above)). HOWEVER, this script cannot find the email server which is on the same box.

so to add more detail, if i use a machine (other than the server) to telnet into the SMTP server (mail.aais.com.au), i will get a response. if i telnet from the SERVER itself and do the same thing, telnet mailaais.com.au, i get cannot find server.

the questions below have been asked before (from other locations other than EE) and i have answered them.. see below

(3) When you type in

formatting link
on your internal network you hit your router http page instead of your server. correct. unless i modify my host file. THIS has now been rectified as my cisco config script has been changed to suit this.

(2) Your DNS server points for xxx.aais.com.au at your external IP correct .. all dns entries are external IP's

(1) You have your own DNS/WEB/Email server sitting on the internal network at 192.168.0.11 correct, all services residing on the same box .. hence all my forwards to the one box

i am for certain this is NOT a server issue. this is (from opinions) a cisco config routing issue. i have included said config below for your review and comment's where available.

--- CICSO 1700 CONFIG SCRIPT --- interface ATM0/0 description +++ CONNECTION TO ISP +++ no ip address no atm ilmi-keepalive bundle-enable dsl operating-mode auto hold-queue 224 in ! interface ATM0/0.1 point-to-point pvc 8/35 pppoe-client dial-pool-number 1 ! ! interface FastEthernet0/0 description +++ LAN +++$ETH-LAN$$FW_INSIDE$ ip address 192.168.0.2 255.255.255.0 ip broadcast-address 192.168.0.255 ip access-group 100 in ip nat inside speed auto full-duplex no cdp enable ! interface Dialer1 description +++ Virtual Connection to ATM0/0 +++$FW_OUTSIDE$ ip address negotiated ip access-group filter-inbound in ip mtu 1492 ip nat outside encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname XXXXXXXXXXXX ppp chap password XXXXXXXXXXXX ! ip nat inside source list 102 interface Dialer1 overload ip nat inside source route-map FWD2WEBSITE interface FastEthernet0/0 overload ip nat inside source static tcp 192.168.0.11 80 interface Dialer1 80 ip nat inside source static tcp 192.168.0.11 25 interface Dialer1 25 ip nat inside source static tcp 192.168.0.11 20 interface Dialer1 20 ip nat inside source static tcp 192.168.0.11 21 interface Dialer1 21 ip nat inside source static tcp 192.168.0.11 443 interface Dialer1 443 ip nat inside source static tcp 192.168.0.11 3200 interface Dialer1

3200 ip nat inside source static tcp 192.168.0.11 53 interface Dialer1 53 ip nat inside source static tcp 192.168.0.11 110 interface Dialer1 110 ip nat inside source static tcp 192.168.0.11 6080 interface Dialer1 6080 ip nat inside source static tcp 192.168.0.11 3389 interface Dialer1 3389 ip nat inside source static udp 192.168.0.11 53 interface Dialer1 53 ip classless ip route 0.0.0.0 0.0.0.0 Dialer1 ip http server ip http access-class 23 ip http authentication local ip http secure-server ip http timeout-policy idle 5 life 86400 requests 10000 ! ip access-list extended filter-inbound permit tcp any any eq 3389 permit tcp any any eq ftp-data permit tcp any any eq ftp permit tcp any any eq 3200 permit tcp any any eq pop3 permit tcp any any eq smtp permit tcp any any eq 6080 permit tcp any any eq 443 permit tcp any any eq www permit udp any any eq domain permit tcp any any eq domain permit tcp any any established permit udp host 192.231.203.2 eq domain any permit udp host 192.231.203.3 eq domain any permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable deny ip 10.0.0.0 0.255.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 192.168.0.0 0.0.255.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip host 255.255.255.255 any deny ip host 0.0.0.0 any deny udp any any ! access-list 23 remark ******************** access-list 23 remark *** Local Access ONLY to Config access-list 23 remark ******************** access-list 23 permit 192.168.0.0 0.0.0.255 access-list 100 remark ******************** access-list 100 remark *** FE0/0 LAN access-list 100 remark ******************** access-list 100 permit ip any any access-list 102 remark ******************** access-list 102 remark *** Traffic NAT'ed access-list 102 remark ******************** access-list 102 permit ip 192.168.0.0 0.0.0.255 any access-list 103 remark ******************** access-list 103 remark *** FWD2WEBSITE access-list 103 remark ******************** access-list 103 permit ip 192.168.0.0 0.0.0.255 host 150.101.163.87 dialer-list 1 protocol ip permit no cdp run route-map FWD2WEBSITE permit 23 match ip address 103 set ip next-hop 192.168.0.11

--- END CONFIG ---

any help / assistance on rectifying this would be great cheers chuck

Reply to
cvanoosbree
Loading thread data ...

from your server, when you ping mail.aais.com.au what IP address is returned ?

Reply to
Merv

i get the external IP address (DNS address / Public Address)

Reply to
cvanoosbree

So does that say when you try to telnet from the server by name, the telnet destination is an external address so the packet will be routed to the ISP first- hop router and then back to your router ?

That being the case, what will you router do with an inbound telnet ?

It looks like your inbound access list will drop all inbound telnet packets ...

Reply to
Merv

So telnet mail.aais.com.au from your server will end up in a telnet packet with an "external" destination IP address

What will your router do with that ?

Reply to
Merv

So does that say when you try to telnet from the server by name, the telnet destination is an external address so the packet will be routed to the ISP first- hop router and then back to your router ?

i hypothesis the following (and im sure im way wrong on this) i think what is happening is that from the server, i telnet to 25 on itself, DNS confirms IP address packet goes to router, router see's its internal packet but now has a header with an external packet web server / email server does not receive an internal ip address packet, and only see's external from router web server drops packet

That being the case, what will you router do with an inbound telnet ? if i telnet from another machine on the network (within the LAN) to mail.aais.com.au 25, all works fine (i will still get an external IP address, however, i WILL get into the port) the failure happens is when i try to telnet from the server itself

It looks like your inbound access list will drop all inbound telnet packets ... if that is the case, is there a config change that needs to be made, and if so, then what?

Cheers

Reply to
cvanoosbree

Perhaps the question that needs to be asked is how to setup DNS so that instead of getting an external address you get the internal address when a DNS request is being made from your internal network

I know nothing about DNS, but one often see discussions about internal DNS versus external DNS, split DNS view, DNS fixup etc on this newsgroup.

Is the external IP address returned for the DNS request "mail.aais.com.au" the same as the IP address on the outside interface (i.e dilaer 0 facing your ISP) ?

Reply to
Merv

i have asked my system admin's at work (which contain about 2500+ employees) and they say that i am setting up DNS correctly. i will have to delve into this a bit more i guess

that is correct. my DNS entry is the external IP address of my router (Dialer1) / 150.101.163.87

right now though, DNS is working fine as everyone on the internet is hitting the website(s) that i am hosting. its just that i cannot get into port 25 when i am on that server. if i ping mail.aais.com.au from that server, i will receive a response which is the dialer1 IP

Reply to
cvanoosbree

i did telnet from within the server .. telnet 192.168.0.11 25 and i did get a response .. just cant do it using the external IP from within the local machine

Reply to
cvanoosbree

So if you setup a host file on the server in question and placed an entry for mail.aais.com.au -> 192.168.0.11 then at least you will have a workaround for now.

Reply to
Merv

oddly enough that worked well (had to allow local relaying on the server after).

i thought using the host file of 192 .. and with an internet user, that the website would look for 192 as that is what is said on the host file.. but i guess that is a work around for now

in the end, do you think its a routing issue?

Reply to
Chuck

That depends on what you are trying to accomplish ...

Sometimes on this newsgroup there are posters who want to have a setup where they send traffic to a "DMZ" server and want to use the outside IP address of the server. I guess the rationale being that they are trying to test their server app and want to ensue the test works as if the user was on the outside (ie. on the Internet).

If this is what you were trying to accomplish then you have a "routing" problem.

If you were just trying to get the script to run, then I would submit you have/had a DNS lookup problem or a minimum this maybe an acceptable solution to the issue.

Reply to
Merv

i will be obtaining a 4 port WIC for this router so i can truely setup a DMZ.. just got to wait for it to come in..

i would anticipate another post from me as to how to setup a DMZ once it does show up

Cheers

Reply to
Chuck

While you wait for your hardware upgrade , take a look at the Cisco IOS Firewall Design Guide

formatting link

Reply to
Merv

cheers for that.. its a lot of reading :)

hopefully cisco sdm can assist in that as well

Reply to
Chuck

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.