Our 3620 router routes all of our other buildings together via ISDN lines. We have each building set up for a different 10.x number. For example, DHCP assigns building 1 with 10.20.0.0 addresses and building 2 with 10.30.0.0 addresses and so forth. This way we can tell which building is having problems by their IP addresses but still use the dandiness of DHCP.
The SME machine is running 5.1.2 with squidguard. That was it's sole purpose for being built. We have to network cards, because the class that we went too for instructions about the E-smith software instructed us to do so. Plus I can only imagine it would make things faster to have two network cards, since we are keeping our network up to date with gigabit ethernet and fiber.
Our server was initially on the same domain, and I simply changed the mail.emsd37.org (our domain if I hadn't mentioned this earlier) from a "self" address to a "local" address and put in the 10.10.0.11 address of our mail server. This not only worked for pinging, but it worked for our web server which we did the same exact process for and it works flawlessly.
YES, the most confusing thing about this entire situation is that our PIX has a static route to send all mail traffic directly to the 10.10.0.11 (mail server) address. When we watch the software on the mail server, it never gets a connection from the sites, such as hotmail when we try to send an email. Once in a while a connection will open with some foreign IP and then close, without sending or receiving any data...
To understand things further, I probably stated this earlier, but it plays an important role:
Our 3620 is our default gateway for all machines. So a quite implementation of our filter server is done by simply changing the gateway of the 3620 from our firewall (10.10.0.1) to our filter server (10.10.0.15). Our filter server is set up with the 10.10.0.1 (firewalls) ip so, it just adds him to the loop and yes, the filtering works terrific... too good, because then, and only then, the mail stops coming in.
We cannot ping mail.emsd37.org from any of our cisco devices, which at first made me think that DNS is not setup correctly, but we have a valid nameserver listed for Internet use, and it cannot even ping
www.yahoo.com. This confused us further. The sad part is, a very long time ago, we had our cisco devices installed for us, because at the time, no one that worked there knew how to do it. There are a lot of parts that don't look correct to us, but we are not sure why they say what they say.
Anyway, I added our DNS server to the name-server list, since it can support up to 6 DNS servers, but that proved useless too, still could not ping. However, on our filter server and all of our machines, I can successfully ping the address mail.emsd37.org and it brings up the correct IP of 10.10.0.11. Since the PIX is set to forward all traffic on 209.7.177.9 to 10.10.0.11, and mail.emsd37.org is registered to the IP of 209.7.177.9, then I'm lost at why we cannot receive our mail.
By the way, one more thing is, almost all of our networks are using the 255.255.0.0 netmask.
The reason our SME server has both interfaces on the same network is simply because we spent a lot of money on the PIX and don't feel it wise to risk vulnerabilities with our SME server on the outside, let alone the rest of our network. Plus, we tried it on the outside, too and it produced the same exact problems. We decided to move it back inside the firewall, so that we can still use the filter servers console to allow or deny access by IP. If it is outside our firewall, then only our PIX could let us assign specific IPs to everyone and that's just too silly to do for this purpose when it's so much easier on the inside, plus we have a nice little jukebox set up on it too.
Thanks for the help so far.... keep the info flowing.
11 Replies
1015 Views