SMTP Between 2 routers

[eddysamson]

Hi all, I am relatively new to IOS and could use some help. We have 2 routers, 1 internal, 1 DMZ/external. Internal is a 1921, DMZ is a 891. We have an interesting setup right now where each router has its own public IP and separate connection to the modem. The 1921 handles all normal internet traffic and has our VPN server for remote access to our internals. The 891 handles our Lync Edge server and will soon have an Exchange Edge server. The I am trying to configure the 891 to forward traffic from the DMZ subnet to the internal subnet and exchange server.



I have done everything that I *think* needs to be done to get this work. My boss believes I should be able to telnet from a dmz machine to our internal exchange server over port 25 and vice versa. However, this does not work.



The 891's fastethernet8 interface is connected directly to the 1921's gigabitethernet0/0 interface.



My config is as follows:



1921(INSIDE)-



*took out anything that doesnt pertain to SMTP traffic and these 2 routers



interface GigabitEthernet0/0

description TO-DMZ

ip address 10.10.1.2 255.255.255.0

ip access-group sdm_gigabitethernet0/0_in in

ip nat outside

ip virtual-reassembly in

ip verify unicast reverse-path

ip policy route-map smtprule

duplex auto

speed auto

no cdp enable



ip nat inside source static tcp 192.168.1.186 25 interface GigabitEthernet0/0 25

ip nat inside source route-map smtprule interface GigabitEthernet0/0 overload



ip route 10.10.10.0 255.255.255.0 GigabitEthernet0/0

!

ip access-list extended sdm_gigabitethernet0/0_in

permit tcp any host 10.10.1.2 eq smtp

permit tcp any host 10.10.1.2 eq 50636

permit tcp any host 192.168.1.186 eq smtp

permit tcp any host 192.168.1.186 eq 50636

permit tcp any any eq 1723

permit gre any any

permit ip 192.168.1.0 0.0.0.255 any

permit ip host 10.10.1.2 any

permit icmp any host 10.10.1.2 administratively-prohibited

permit icmp any host 10.10.1.2 time-exceeded

permit icmp any host 10.10.1.2 unreachable

deny ip 10.0.0.0 0.255.255.255 any

deny ip 172.16.0.0 0.15.255.255 any

deny ip 192.168.0.0 0.0.255.255 any

deny ip 127.0.0.0 0.255.255.255 any

deny ip host 255.255.255.255 any

deny ip host 0.0.0.0 any

deny ip any any log



access-list 151 permit tcp host 192.168.1.186 eq smtp any

access-list 151 permit tcp host 192.168.1.186 any eq smtp

access-list 151 permit ip host 192.168.1.186 any

!

route-map smtprule permit 5

match ip address 151

set interface GigabitEthernet0/0

!



891(DMZ)-



interface FastEthernet8

ip address 10.10.1.10 255.255.255.0

ip nat outside

ip policy route-map smtprule

duplex auto

speed auto

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$

ip address 10.10.10.1 255.255.255.0

ip access-group 102 in

ip nat inside

ip virtual-reassembly in

ip tcp adjust-mss 1452

!

ip nat inside source route-map smtprule interface FastEthernet8 overload

ip route 192.168.1.0 255.255.255.0 FastEthernet8





access-list 151 permit tcp host 10.10.10.3 eq smtp any

access-list 151 permit tcp host 10.10.10.3 any eq smtp

access-list 151 permit ip host 10.10.10.3 any



route-map smtprule permit 5

match ip address 151

set interface FastEthernet8



A few things to note:



*10.10.10.3 is the exchange edge server

*192.168.1.186 is the exchange server

*in the 1921's ACL I tried both the IP of the fastethernet8(DMZ) interface and what you see currently which is the gigabitethernet0/0(inside) interface

*the route-map is just a test, I am really not sure if it was even necessary. Things are looking exactly the same since I put it in.



My boss is convinced SMTP wont flow between the two routers until I can telnet on port 25 to each respective machine, is this true? From each router I can ping machine IPs off the other router, but machines themselves can not ping machines on the other router (or the router itself). So for instance while in 891 I can ping 192.168.1.186 and while on the 1921 I can ping 10.10.10.3 but I cannot ping 192.168.1.186 from 10.10.10.3 or vice versa.



What am I missing? I was originally under the impression that static routes were the only thing I needed. After I added them it opened up the pinging I was talking about, but still cannot telnet on 25.



Please help!