Cisco POP3 forwarding

Your original post on May 14th was responded to. Perhaps you should refer to the response.

Best Regards, News Reader

That message list was deleted, and due to unforeseen circumstances can no longer be recovered. Apologies. Any help is still appreciated

This is the response to your initial post on May 14th.:

siik wrote: > Hi, >

You are only allotting 5% of you memory for I/O. You might want to use "show memory summary", and verify that you have adequate "free" I/O memory. This might bite you some day.

You need to change these passwords. They should not have been included in your post. Type 7 passwords are easily decrypted with readily available tools and takes less than 1 sec. You may even want to change the usernames, and not include them in future posts.

You should not have included this password in your post. You need to change it now!

You should consider an ACL on the inside interface to implement a reasonable security policy. If you do, then use inspection on the outside interface to provision the return path.

You need to change these passwords. They should not have been included in your post. Type 7 passwords are easily decrypted with readily available tools and takes less than 1 sec.

You might want to place icmp permit ACEs after the permit ACEs for your servers. Presumably there is more traffic to the servers (www, smtp, etc.) than icmp traffic. The sooner you match a given packet in an ACL, the sooner you stop processing the ACL, and forward the packet.

permit tcp any host 203.153.229.11 eq pop3

Remote administration should not be done with Telnet (clear text). They should be using SSH (encrypted).

You need to change this password. It should not have been included in your post. Type 7 passwords are easily decrypted with readily available tools and takes less than 1 sec.

The Access Control Entry (ACE), is part of the access-list. When you enter configuration mode (config t), you then need to enter the specific ACL configuration mode to add an ACE to the ACL:

Do a "show ip access-list ACL-Outside"

Note the sequence numbers beside the ACEs (they probably start at 10, and increment by 10's).

Lets assume you saw this:

110 permit icmp any any unreachable 120 permit tcp any host 203.153.229.11 eq smtp

You might decide that you wanted to place your ACE between these two ACEs. You would specify a sequence number between 110 and 120.

e.g.: devicename(config) # ip access-list extended ACL-Outside devicename(config-ext-nacl) # 115 permit tcp any host 203.153.229.11 eq pop3 devicename(config-ext-nacl) # ex devicename(config) # ip access-list resequence ACL-Outside 10 10

This would resequence the ACEs, starting at 10, and incrementing by 10.

Exit configuration mode, do a "show ip access-list ACL-Outside", and verify the result:

e.g.:

110 permit icmp any any unreachable 120 permit tcp any host 203.153.229.11 eq pop3 130 permit tcp any host 203.153.229.11 eq smtp

Best Regards, News Reader