Checkpoint and Exchange

[Peach66]

I have a Checkpoint firewall, two Win2000 servers. One of the servers is Exchange 5.5. For some reason, I lose connection to the Exchange server. The only fix is to reboot the firewall. It works for the entire week, but on Saturday (random time) it no longer works. Internally, all the workstations can access their mailboxes and send emails to internal users. Only external email is blocked. I don't see anything in the Event logs to tell me why it loses it's connection. Any ideas?

 

[moonlight1]

Do you have FW-1 module installed in your Exchange machine?
if you do then which version is it and which version is runing at your managment moduke?

 

[Peach66]

No I don't have FW-1 module running on Exchange Server. It's actually running on the Firewall itself.

 

[rn4it]

Just to confirm, your FW is 1 box and the Exchange is a second box. I would look at the log file on the FW during time. Basically you want to see communication from your exchange server to the outside world. Does your Exchange have it's own NAT address? if it does you may want to search on that. Here is a article from MS

http://support.microsoft.com/default.aspx?scid=kb;en-us;148732

maybe beneficia. Also confirm your config and rules, you may have the exchange server attempting to use ports it's not allowed.

 

[ChrisAC]

I've had the same problem. The internal clients can access the mail server but no one can connect to it from the outside. Providing that your NAT rules and security rules have not changed then I suspect that this is a proxy arp problem.

If you are doing a static NAT to your mail server then the firewall will have to arp on behalf of that server. On NT server local.arp works just fine but we have found that on Windows 2000 server this doesn't work so well and proxy arp stops working at least once or twice a week. We tried using automatic ARP on NG FP3 and local.arp but neither worked. In the end the fix was putting the MAC address of the mail server on the router so that the router wouldn't have to ARP for it.

Hasn't failed since!!

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************